DOM-Based XSS Detection via Unique Payload Identification

Solution Overview

Problem

Web applications using dynamic HTML templates are vulnerable to DOM-based cross-site scripting (XSS) attacks, where malicious payloads can be echoed into the Document Object Model (DOM), altering the application's behavior and response, making it difficult to detect and prevent such vulnerabilities.

Innovation Solution

A system and method that involves sending payloads with unique identifiers to a Web-based application to simulate XSS attacks, identifying vulnerable areas in the DOM, and generating a DOM abstraction to perform static analysis, highlighting un-trusted content and indicating potential vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If dynamic HTML templates are used to instantiate responses with user-provided values, then the Web application becomes more sophisticated and flexible, but it becomes vulnerable to DOM-based XSS attacks where malicious payloads can be echoed into the DOM

Engineering Contradiction:

Improvedynamic template instantiationVSAvoidDOM-based XSS vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary action by sending test payloads with unique identifiers to the Web application before actual deployment, identifying vulnerable DOM sections in advance. This allows the creation of a DOM abstraction that marks untrusted content sections, preventing malicious payloads from executing while maintaining dynamic template functionality.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A DOM abstraction layer is introduced as an intermediary between the dynamic HTML templates and the actual DOM rendering. This abstraction layer contains identified untrusted content sections and prevents malicious payloads from directly affecting the DOM, while still allowing legitimate dynamic content to be rendered safely.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If the Web application echoes user-provided HTML markup into the DOM at runtime, then the application can dynamically respond to user requests, but malicious HTML markup can alter the application's behavior and render undesired responses

Engineering Contradiction:

Improvedynamic response generationVSAvoidresponse integrity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system performs preliminary action by sending test payloads with unique identifiers to the Web application before actual deployment, identifying vulnerable DOM sections in advance. This allows the creation of a DOM abstraction that marks untrusted content sections, preventing malicious payloads from executing while maintaining dynamic template functionality.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A DOM abstraction layer is introduced as an intermediary between the dynamic HTML templates and the actual DOM rendering. This abstraction layer contains identified untrusted content sections and prevents malicious payloads from directly affecting the DOM, while still allowing legitimate dynamic content to be rendered safely.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If malicious payloads are injected into the DOM, then the payloads can be indistinguishable from legitimate DOM content, but this makes detection and prevention of XSS vulnerabilities difficult

Engineering Contradiction:

ImproveDOM content renderingVSAvoidXSS vulnerability detection

Core Design Contradiction:

Ease of operationVSDifficulty of detecting and measuring

Solution Approach 1:

The system uses unique identifiers (analogous to color changes) embedded in test payloads to mark and identify malicious content within the DOM. These identifiers make malicious payloads distinguishable from legitimate DOM content, enabling the DOM abstraction to identify and isolate untrusted sections for prevention.

Inventive Principle:

Principle #32Color changes

Data Source

PatentUS8683596B2Detection of DOM-based cross-site scripting vulnerabilities

Publication Date: 2014.03.25 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Testing a Web-based application for security vulnerabilities. At least one client request including a payload having a unique identifier can be communicated to the Web-based application. Response HTML and an associated Document Object Model (DOM) object can be received from the Web-based application. Content corresponding to the payload can be identified in the DOM object via the unique identifier. A section of the DOM object including the payload can be identified as un-trusted.