Connect with us

Hi, what are you looking for?


Application Security

New Attack Combines Self-XSS and Clickjacking

A researcher has demonstrated an attack that combines Clickjacking and a type of Cross Site Scripting (XSS) called Self-XSS. The new attack can trigger Self-XSS on pages that are also vulnerable to Clickjacking, the researcher says.

A researcher has demonstrated an attack that combines Clickjacking and a type of Cross Site Scripting (XSS) called Self-XSS. The new attack can trigger Self-XSS on pages that are also vulnerable to Clickjacking, the researcher says.

Dubbed XSSJacking and detailed by Dylan Ayrey, the attack abuses “Pastejacking”, which is a method of replacing user’s clipboard with attacker-controlled content. Detailed by the same researcher, this technique can only be triggered on browser events, but it allows an attacker to gain code execution by tricking a user into running commands they didn’t want to run.

XSSJacking, Ayrey explains, takes advantage of Pastejacking to force users to paste XSS payloads into text fields framed from other domains. Furthermore, an attacker could trick the user into believing they are interacting with another website, by redressing the frames, making them invisible, and overlaying them on top of other interface elements.

Self-XSS and Clickjacking are often excluded from bug bounty payouts, but the researcher demonstrates that there are relatively practical ways to execute XSS payloads on websites that are vulnerable to both of them.

The Self-XSS vulnerability is usually triggered when the user types in an XSS payload that triggers on itself. This, the researcher says, can be set in a field that only the user can view. Clickjacking, on the other hand, relies on framing a website of a logged in user (usually by setting the opacity of the frame to 0) and forcing the victim to interact with their account on a different website.

To demonstrate the attack, the researcher set up two websites, the first of which has an input field vulnerable to Self-XSS, but designed to only pop an alert if specific code (<script>alert(1)</script>) is entered into the field. The second site asks users to input their email address twice, which entices them to use the Copy-Paste pair of commands (many write the email address in the first field, then copy and paste it in the second field).

“This is where the Pastejacking comes in. After the copy, the contents of their clipboard get overwritten with <script>alert(1)</script>. The second email field is actually a cropped Iframe of the vulnerable site. When the victim goes to paste their email into the field, they’ll actually paste the script tag, and trigger the XSS on the victim’s domain,” Ayrey notes.

Advertisement. Scroll to continue reading.

The researcher concludes that, although Clickjacking and Self-XSS are typically excluded from bug bounties, an attacker can easily craft a payload to force the XSS to trigger, if both vulnerabilities are present on the website.

Related: XSS Flaws Decline, DoS Becomes More Common: Imperva

Related: XSS Found in Silently Installed Acrobat Chrome Extension

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...