XSS Vulnerabilities in Cloud-Application Add-Ons

by   Thanh Bui, et al.

Cloud-application add-ons are microservices that extend the functionality of the core applications. Many application vendors have opened their APIs for third-party developers and created marketplaces for add-ons (also add-ins or apps). This is a relatively new phenomenon, and its effects on the application security have not been widely studied. It seems likely that some of the add-ons have lower code quality than the core applications themselves and, thus, may bring in security vulnerabilities. We found that many such add-ons are vulnerable to cross-site scripting (XSS). The attacker can take advantage of the document-sharing and messaging features of the cloud applications to send malicious input to them. The vulnerable add-ons then execute client-side JavaScript from the carefully crafted malicious input. In a major analysis effort, we systematically studied 300 add-ons for three popular application suites, namely Microsoft Office Online, G Suite and Shopify, and discovered a significant percentage of vulnerable add-ons in each marketplace. We present the results of this study, as well as analyze the add-on architectures to understand how the XSS vulnerabilities can be exploited and how the threat can be mitigated.


page 1

page 2

page 3

page 4


Over 100 Bugs in a Row: Security Analysis of the Top-Rated Joomla Extensions

Nearly every second website is using a Content Management System (CMS) s...

BabelView: Evaluating the Impact of Code Injection Attacks in Mobile Webviews

A Webview embeds a full-fledged browser in a mobile application and allo...

SōjiTantei: Function-Call Reachability Detection of Vulnerable Code for npm Packages

It has become common practice for software projects to adopt third-party...

A Sweet Recipe for Consolidated Vulnerabilities: Attacking a Live Website by Harnessing a Killer Combination of Vulnerabilities

The recent emergence of new vulnerabilities is an epoch-making problem i...

Deep ahead-of-threat virtual patching

Many applications have security vulnerabilities that can be exploited. I...

Set CRDT com Múltiplas Políticas de Resolução de Conflitos

Um CRDT é um tipo de dados que pode ser replicado e modificado concorren...

Unsafe at Any Copy: Name Collisions from Mixing Case Sensitivities

File name confusion attacks, such as malicious symbolic links and file s...

Please sign up or login with your details

Forgot password? Click here to reset