Conference Venue: RAI Amsterdam, Europaplein 24, 1078 GZ Amsterdam, The Netherlands

Book Hotel click HERE
Back To Schedule
Friday, September 27 • 1:45pm - 2:30pm
ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Feedback form is now closed.
The direct client-side inclusion of cross-origin JavaScript resources in Web applications is a pervasive practice to consume third-party services and to utilize externally provided libraries. The downside of this practice is that such external code runs in the same context and with the same privileges as the first-party code. Thus, all potential security problems in the code directly affect the including site. To explore this problem, we present an empirical study which shows that more than 25% of all sites affected by Client-Side Cross-Site Scripting are only vulnerable due to a flaw in the included third- party code. Motivated by this finding, we propose ScriptProtect, a non- intrusive transparent protective measure to address security is- sues introduced by external script resources. ScriptProtect au- tomatically strips third-party code from the ability to conduct un- safe string-to-code conversions. Thus, it effectively removes the root-cause of Client-Side XSS without affecting first-party code in this respective. As ScriptProtect is realized through a light- weight JavaScript instrumentation, it does not require changes to the browser and only incurs a low runtime overhead of about 6%. We tested its compatibility on the Alexa Top 5,000 and found that 30% of these sites could benefit from ScriptProtect’s protection today without changes to their application code.

avatar for Marius Musch

Marius Musch

Marius Musch is a PhD candidate at the Insitute for Application Security at TU Braunschweig in Germany. His field of research is web application security with a focus on client-side attacks and large-scale analyses.

Friday September 27, 2019 1:45pm - 2:30pm CEST