Re: Help with referer issues in XSS

Referrer header defense is reasonable for intranet facing applications
where referrer header policy is controlled.

Some organizations choose to strip all outbound referrer headers to
prevent information leakage. Therefor referrer defense of this nature
is not always workable for internet facing applications.

So really, you are better off using entropy (random tokens) for CSRF
defense, and proper validation and escaping for XSS defense.

--
Jim Manico
VP, Security Architecture
WhiteHat Security
(808) 652-3805

On Mar 2, 2012, at 7:42 PM, Tim <[email protected]> wrote:

>
> Hello,
>
>
>> Suppose there is a reflect XSS vulnerability in a pop SNS, but this
>> site is "concerned" about security, so they check the referer field of
>> certain POST request to make sure that they are normal and correct. Is
>> it possible for me to bypass this check within javascript? It seems
>> that I can't set this parameter like this:
>>
>> xmlHttp.setRequestHeader("Referer","http://expected.target");
>>
>> It would be appreciated if someone can give me a clue.
>
>
> I'm always interested to see what the community's response is to this
> question.  It comes up relatively frequently in the context of CSRF
> (since this kind of checking can mitigate CSRF).  Often most people
> are skeptical that this kind of checking is sufficient to prevent CSRF
> and reflected XSS, but in recent times, I am not aware of a way around
> it in the general case.
>
> Old versions of Flash do allow one to set Referer cross-domain, but it
> is my impression this was fixed quite some time ago.  Various XHR API
> vulnerabilities have also existed in the past to allow for injection
> of restricted headers, like Referer, but these could be seen as
> browser vulnerabilities.
>
> Recently [1] it was pointed out how headers containing '-' can be
> spoofed due to foolishness in CGI-compatible APIs that transliterate
> header names, but Referer of course doesn't have a '-'.
>
> Can anyone give an example of how one would get around Referer
> checking?
>
> tim
>
>
> 1. http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-January/008170.html
>
> _______________________________________________
> The Web Security Mailing List
>
> WebSecurity RSS Feed
> http://www.webappsec.org/rss/websecurity.rss
>
> Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA
>
> WASC on Twitter
> http://twitter.com/wascupdates
>
> [email protected]
> http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

[email protected]
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org