Top 10 winner

Permanent backdooring of HTML5 client-side application

Joey Tyson · Security Musings · 1 February 2012

Caching application JavaScript in HTML5 localStorage turns any reflected XSS on the caching origin into a persistent, self-reloading compromise. The article documents a real case: the Apture widget cached 272KB of code and eval'd it, and a reflected XSS on cdn.apture.com let an attacker poison that cache. The payload then executed on every third-party site embedding Apture.

Record

Researcher

Joey Tyson

Published by

Security Musings

Date

1 February 2012

In the archive

• Ranked #7 in the 2012 Top 10 Web Hacking Techniques

Related sources

• Detailed background talk
• Foundational research paper

Tags

• xss
• javascript
• cache
• supply-chain
• case-study
• dom
• owasp-a03-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Joey Tyson, first published at the original source. Preserved copies are kept so the citation survives its host.