A researcher has demonstrated an attack that combines Clickjacking and a type of Cross Site Scripting (XSS) called Self-XSS. The new attack can trigger Self-XSS on pages that are also vulnerable to Clickjacking, the researcher says.
Dubbed XSSJacking and detailed by Dylan Ayrey, the attack abuses “Pastejacking”, which is a method of replacing user’s clipboard with attacker-controlled content. Detailed by the same researcher, this technique can only be triggered on browser events, but it allows an attacker to gain code execution by tricking a user into running commands they didn’t want to run.
XSSJacking, Ayrey explains, takes advantage of Pastejacking to force users to paste XSS payloads into text fields framed from other domains. Furthermore, an attacker could trick the user into believing they are interacting with another website, by redressing the frames, making them invisible, and overlaying them on top of other interface elements.
Self-XSS and Clickjacking are often excluded from bug bounty payouts, but the researcher demonstrates that there are relatively practical ways to execute XSS payloads on websites that are vulnerable to both of them.
The Self-XSS vulnerability is usually triggered when the user types in an XSS payload that triggers on itself. This, the researcher says, can be set in a field that only the user can view. Clickjacking, on the other hand, relies on framing a website of a logged in user (usually by setting the opacity of the frame to 0) and forcing the victim to interact with their account on a different website.
To demonstrate the attack, the researcher set up two websites, the first of which has an input field vulnerable to Self-XSS, but designed to only pop an alert if specific code () is entered into the field. The second site asks users to input their email address twice, which entices them to use the Copy-Paste pair of commands (many write the email address in the first field, then copy and paste it in the second field).
“This is where the Pastejacking comes in. After the copy, the contents of their clipboard get overwritten with . The second email field is actually a cropped Iframe of the vulnerable site. When the victim goes to paste their email into the field, they’ll actually paste the script tag, and trigger the XSS on the victim’s domain,” Ayrey notes.
The researcher concludes that, although Clickjacking and Self-XSS are typically excluded from bug bounties, an attacker can easily craft a payload to force the XSS to trigger, if both vulnerabilities are present on the website.
Related: XSS Flaws Decline, DoS Becomes More Common: Imperva
Related: XSS Found in Silently Installed Acrobat Chrome Extension