PathCutter: Severing the Self-Propagation Path of XSS JavaScript Worms in Social Web Networks.

Yinzhi Cao,Vinod Yegneswaran,Phillip A. Porras,Yan Chen

2012-01-01

Abstract:Worms exploiting JavaScript XSS vulnerabilities rampantly infect millions of web pages, while drawing the ire of helpless users. To date, users across all the popular social networks, including Facebook, MySpace, Orkut and Twitter, have been vulnerable to XSS worms. We propose PathCutter as a new approach to severing the self-propagation path of JavaScript worms. PathCutter works by blocking two critical steps in the propagation path of an XSS worm: (i) DOM access to different views at the client side and (ii) unauthorized HTTP request to the server. As a result, although an XSS vulnerability is successfully exercised at the client, the XSS worm is prevented from successfully propagating to the would-be victim’s own social network page. PathCutter is effective against all the current forms of XSS worms, including those that exploit traditional XSS, DOM-based XSS, and content sniffing XSS vulnerabilities. We present and evaluate both a server-side and proxyside deployment of PathCutter. We implement PathCutter on WordPress and Elgg and demonstrate its resilience against two proof-of-concept attacks. We also evaluate the PathCutter implementation on five real-world worms: Boonana, MySpace Samy, Renren, SpaceFlash, and the Yamanner worm. We show that although the worms themselves exploit different vulnerabilities, at either the client side or server side, they are successfully thwarted by PathCutter as it is vulnerability agnostic and blocks the propagation path of the infection. Our performance evaluation shows that rendering overhead of PathCutter is less than 4%, and memory overhead for one additional view is less than 1%.