CAPEC-104 - Cross Zone Scripting

An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.






  • Attack Methods 2
  • Analysis
  • Injection
  • Purposes 1
  • Exploitation
  • Sec Principles 2
  • Enforce least privilege
  • Reluctance to trust
  • Scopes 4
  • Modify memory
  • Modify files or directories
  • Modify application data
  • Integrity
  • Read memory
  • Read files or directories
  • Read application data
  • Confidentiality
  • Gain privileges / assume identity
  • Authorization
  • Access_Control
  • Confidentiality
  • Execute unauthorized code or commands
  • Availability
  • Integrity
  • Confidentiality

Medium level: Ability to craft malicious scripts or find them elsewhere and ability to identify functionality that is running web controls in the local zone and to find an injection vector into that functionality

The target must be using a zone-aware browser.

No specialized equipment is needed

Step 1 - Find systems susceptible to the attack

Find systems that contain functionality that is accessed from both the internet zone and the local zone. There needs to be a way to supply input to that functionality from the internet zone and that original input needs to be used later on a page from a local zone..

Tecnique ID: 1 - Environment(s) env-Web

Leverage knowledge of common local zone functionality on targeted platforms to guide attempted injection of code through relevant internet zone mechanisms. In some cases this may be due to standard system configurations enabling shared functionality between internet and local zones. The attacker can search for indicators that these standard configurations are in place.

Security Control ID: 1

Type: Preventative

Ensure standard system configurations do not enable shared functionality between internet and local zones

Step 1 - Find the insertion point for the payload

The attacker first needs to find some system functionality or possibly another weakness in the system (e.g. susceptibility to cross site scripting) that would provide the attacker with a mechanism to deliver the payload (i.e. the code to be executed) to the user. The location from which this code is executed in the user's browser needs to be within the local machine zone..

Tecnique ID: 1 - Environment(s) env-Web

Finding weaknesses in functionality used by both privileged and unprivileged users.

Step 1 - Craft and inject the payload

Develop the payload to be executed in the higher privileged zone in the user's browser. Inject the payload and attempt to lure the victim (if possible) into executing the functionality which unleashes the payload..

Tecnique ID: 1 - Environment(s) env-Web

The attacker makes it as likely as possible that the vulnerable functionality into which he has injected the payload has a high likelihood of being used by the victim.

Tecnique ID: 2 - Environment(s) env-Web

Leverage cross-site scripting vulnerability to inject payload.

Disable script execution.

Ensure that sufficient input validation is performed for any potentially untrusted data before it is used in any privileged context or zone

Limit the flow of untrusted data into the privileged areas of the system that run in the higher trust zone

Limit the sites that are being added to the local machine zone and restrict the privileges of the code running in that zone to the bare minimum

Ensure proper HTML output encoding before writing user supplied data to the page