The Difference Between Cross-frame and Cross-site Scripting

May 31, 2014

from securestate.blogspot.com

There’s a lot of confusion around Cross-frame Scripting.

I’ve seen a number of online resources that describe it as just another type of Cross-site scripting, which only makes sense if you also misunderstand Cross-site scripting.

A significant part of the misunderstanding comes from authoritative sources being unclear at best—if not outright incorrect—in how they explain the issue:

This is a noble pass, but three things are wrong with this opening: a) you shouldn’t use the term you’re defining as part of its definition, b) we brought in XSS when it was unnecessary (and confusing) to do so, and c) at the end of these two sentences we still don’t know what XFS is.

Clarity

Let’s be more plain and direct in our language:

  1. Cross-site Scripting can best be thought of as “Forced JavaScript Execution”. The attacker either stores or reflects malicious JavaScript on a vulnerable website, which is then executed by the victim.

  2. Cross-frame Scripting is best conceptualized as “Data Leakage Through Frame Embed”. It’s a browser bug that allows an attacker to embed a victim’s site in their own, within a frame, and then spy on what’s done on the victim site (like logging in).

Notice how different these are. One is basically arbitrary code execution, while the other is data leakage through what’s far more similar to a phishing attack.

Another way to see how distinct they are is to consider the defenses. With XSS the solution is input validation and output sanitization. With XFS the common advice is frame-busting and hoping your users aren’t using broken browsers to visit malicious websites. Big difference.

Summary

  1. XSS is about forced code execution due to a vulnerability on your website

  2. XFS is about phishing-style data leakage via someone embedding your site into a malicious page through an iFrame

Notes

  1. There’s obviously DOM-based XSS as well, but I left it out for brevity/clarity.

  2. As a leader on multiple OWASP projects I know OWASP is not infallible. It’s often a best-effort type of thing, and people should be encouraged to try to help out when they can. But sometimes the best thing to say about a topic is nothing, as bad information is often much worse than no information at all.

  3. I’ll be submitting some recommended changes to the article in question.

  4. It’s not just the OWASP site that has this problem with explaining XFS; it’s most sites.

  5. Securestate’s article on XFS.

  6. This blog also appeared on hp.com

Related posts: