Cross-Site Scripting: SOP Bypass

Allowing user input to control settings which determine Same-Origin Policy (SOP) can create XSS vulnerabilities.

Cross-site scripting (XSS) vulnerabilities through Same-Origin Policy (SOP) bypasses occur when:

1. Data enters a web application through an untrusted source.


2. The data is passed to a setting that determines the origin of the page where scripts can run, such as document.domain.

Once this is performed, this enables an attacker on another domain to set document.domain the same, and execute scripts on the page, as if in they are located on the exact same domain.

Example 1: The following takes a URL parameter domain and passes it as the domain for the page's Same-Origin Policy (SOP).

<SCRIPT>
var pos = document.URL.indexOf("domain=")+7;
document.domain = document.URL.substring(pos,document.URL.length);
</SCRIPT>

Most browsers will only allow a valid superdomain to be passed to document.domain, therefore if the page is located at "http://www.example.com", then document.domain can be set to "www.example.com", or "example.com". It cannot be set to "com" or "example.org".
However, if an attacker is on another part of the website which they can control, they may be able to execute scripts on part of the site that they do not have control over.