Return to topic cards

Understanding DOM-Based Attacks

cybersecurityDOMJavaScriptweb securityinput validation

DOM-based attacks occur when user input is not sufficiently validated and sanitized before being used in JavaScript to alter the DOM. These attacks can be simplified by identifying sources and sinks within the code.

Key Points

  • Source: The location where untrusted data is provided by the user to a JavaScript function.
  • Sink: The location where the data is used in JavaScript to update the DOM.

DOM-Based Open Redirection

DOM-based open redirection occurs when the frontend uses information from the # value in the URL to determine navigation. This can lead to unintended redirections if not properly sanitized.

Example

Consider the following code snippet:

goto = location.hash.slice(1)
if (goto.startsWith('https:')) {
  location = goto;
}
  • Source: location.hash.slice(1)
  • Sink: The value is directly set in the location of the DOM without sanitization.

Possible Exploit

A malicious URL like https://realwebsite.com/#https://attacker.com can redirect users to a malicious website once the DOM loads.

Learn More

To further understand and mitigate DOM-based attacks, consider the following:

  • Input Validation: Always validate and sanitize user input.
  • Security Best Practices: Follow best practices for secure coding in JavaScript.
  • Regular Audits: Conduct regular security audits to identify and fix vulnerabilities.