CTRL-C + CTRL-V = XSS / ‘Underestimated’ dangers of copy and paste exposed

guest · Jun 17, 2020

‘Underestimated’ dangers of copy and paste exposed
CTRL-C + CTRL-V = XSS
June 16, 2020
https://portswigger.net/daily-swig/underestimated-dangers-of-copy-and-paste-exposed

Quirks in the copy and paste functionality used by web browsers, text editors, and websites can be abused to execute cross-site scripting (XSS) attacks and data exfiltration, a security researcher has discovered.

Users put themselves at risk if they copy content from malicious sites to their clipboard, then paste that data to a WYSIWYG editor within a legitimate website.
Building on recently published research that focused on the TinyMCE text editor, Michał Bentkowski published a deep dive into his copy and paste exploits yesterday (June 15).

The researcher, who also discovered an XSS flaw in CKEditor this year, won bug bounties totaling more than $30,000 after unearthing four security issues in web browsers and five vulnerabilities in rich-text editors.
Click to expand...

Building on ‘Copy and Pest’
Bentkowski, who is chief security researcher at Polish cybersecurity outfit Securitum, said his work built on 2015 research from Mario Heiderich, who showed how copying data from non-browser applications like LibreOffice or Microsoft Word and pasting it into browsers could lead to XSS. [...]
‘Extremely vague’
“I have shown that pasting content from clipboard appears to be an underestimated attack vector,” Bentkowski said in his research post.

Describing the “specification of Clipboard APIs” as “extremely vague on sanitizing content on pasting”, he urged browser vendors to develop specific sanitization rules that “are safe and consistent” across all browsers.

He told The Daily Swig: “I expect more attacks in the coming months. I hope that my research will raise awareness and make more people report bugs in WYSIWYG editors because my impression is that they’re not well protected against these types of attacks in general.”
Click to expand...

Securitum: The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers

This writeup is a summary of my research on issues in handling copying and pasting in: browsers, popular WYSIWYG editors, and websites. Its main goal is to raise awareness that the following scenario can make users exposed to attacks:

The victim visits a malicious site,

The victim copies something from the site to the clipboard,

The victim navigates to another site (for instance Gmail) with WYSIWYG editor.

The victim pastes data from the clipboard.

Click to expand...

Log in or Sign up

CTRL-C + CTRL-V = XSS / ‘Underestimated’ dangers of copy and paste exposed

guest Guest

Log in or Sign up

CTRL-C + CTRL-V = XSS / ‘Underestimated’ dangers of copy and paste exposed

guest Guest

Useful Searches