Abstract:Nowadays, modern websites are utilizing service workers to provide users with app-like functionalities such as offline mode and push notifications. To handle such features, the service worker is equipped with special privileges including HTTP traffic manipulation. Thus, it is designed with security as a priority. However, we find that many websites introduce a questionable practice that can jeopardize the security of a service worker. In this work, we demonstrate how this practice can result in a cross-site scripting (XSS) attack inside a service worker, allowing an attacker to obtain and leverage service worker privileges. Due to the uniqueness of these privileges, such attacks can lead to more severe consequences compared to a typical XSS attack. We term this type of vulnerability as Service Worker based Cross-Site Scripting (SW-XSS). To assess the real-world security impact, we develop a tool called SW-Scanner and use it to analyze top websites in the wild. Our findings reveal a worrisome trend. In total, we find 40 websites vulnerable to this attack including several popular and high ranking websites. Finally, we discuss potential defense solutions to mitigate the SW-XSS vulnerability.

ON AJAX-BASED WEB SERVICE FRAMEWORK AND SECURITY

Research on security extensions based on Java 2 security architecture

Application of Ajax in Web-based Process Control and Monitoring System

Performance Analysis on Magistral Application Technology in Web 2.0——AJAX

Construction of security architecture of web services based EAI

Ajax And Web Services Integrated Framework Based On Duplicate Proxy Pattern

Struts Analysis and Its Application Research

A NEW SAFE FRAMEWORK OF ENTERPRISE APPLICATION INTEGRATION BASED ON WEB SERVICES

A new architecture of Ajax web application security crawler with finite-state machine

Research and implementation of web application based on Ajax

WebGIS System Design Based on AJAX

Security Study of Service Worker Cross-Site Scripting

WEB SERVICES SECURITY MECHANISM AND SECURITY TECHNOLOGY

Research of On-line Examination System Based on AJAX

A new research of Internet mapping service based on AJAX

A Resolvment of the Web Security Based on B/S Structure

A Survey on Access Control for Web Services

Component Composition Technology and Tool Based on AJAX for Web Application

A System Framework of Security Management in Enterprise Systems

A Framework and It's Application for Security Architecture of Computer Networks

A Service-oriented Adaptive Web Application Framework