Hacker News Reader

Comment by realusername | Hacker News Reader

I still don't see how it's a problem either way. The browser should check that the hash matches before storing it into the cache so evil.com/evil.js has not the right hash so it's not stored. If they can craft a sha256 collision then, we have other problems anyway and sha256 should be deprecated. If the hashes are the same, then the files are the same.

View on HN

The hash would be correct. The JS file is the same. The key to the attack is: "the XSS attack is loading <script src=www.victim.com/evil.js hash=foo>". So victim.com was never hosting evil.js and never intended to serve it. The visitor to victim.com gets it because of an XSS vulnerability.

victim.com should be protected because it's content security policy tells the browser not to run scripts from evil.com, but the browser thinks that evil.js came from victim.com, even though victim.com doesn't host evil.js and the browsers cache got evil.js from evil.com.

But if the scenario is an attacker who can inject HTML tags, why wouldn't they simply run their script directly via <script>do_evil();</script>?

Because a properly configured content security policy will block any inlined js (and external js files on non whitelisted domains)

The problem is that www.victim.com/evil.js doesn't exist, and never did, but your browser won't know that if it is in it's cache -- this gives you a way of faking files existing on other servers at the URL of your choices, and as long as they are in the cache you'll get away with it.

Oh I see ! I actually did not consider this case. This requires indeed more reflection than I initially thought.

Edit: But if we only make the global cache work on the same domain, this problem should disapear completely (it's obviously not as powerfull then but still a massive improvement to the current system)

> still a massive improvement to the current system

How so? Browsers have had caches for consistent URIs for some time now.

Yes sure it works but it's still domain based. The browser is still downloading the same copy of jquery 100s of times during a browsing session.

No, the attacker decides the hash, since they inject the <script> tag using XSS.

Reply on news.ycombinator.com