Why is a third party script accessing the cookie?

K

KaminskyIlya2019-10-28 07:18:17

JavaScript

KaminskyIlya, 2019-10-28 07:18:17

A third-party 3dparty.js script from the www.test2.ru domain tries to access a cookie from the ww.test1.ru domain. This script is executed in the context of the www.test1.ru page.
There is a test page from the www.test1.ru domain:

<html>
<head>
  <script>
    var h = window.location.host;
    document.cookie = 'Victim=Vulnerable; domain='+h+'; path=/; max-age=3600; samesite=strict';		
  </script>
</head>
<body>
  Hello world!
  <script src="http://www.test2.ru/3dparty.js" defer></script>
</body>
</html>

There is a 3dparty.js script downloaded from a third-party domain www.test2.ru:

console.log( 'Cookie from foreign domain: ' + document.cookie );

var script = document.createElement('script');
script.innerHTML = 'console.log( "Cookie from victim domain: " + document.cookie )';
document.body.appendChild( script );

When executed, the following is displayed in the console:

Cookie from foreign domain: Victim=Vulnerable
Cookie from victim domain: Victim=Vulnerable

I expected that at least the output of the first line would be: Cookie from foreign domain: undefined.
How can I block the access of the 3dparty.js script for cookies from the www.test1.ru domain here?

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

D

dollar, 2019-10-28
@dollar

Run on a different domain in an iframe. Then it will be a window to another page. Like a browser within a browser. And your page will not know that inside the iframe, no matter what it shows, it will only know the sizes and the address. And the iframe itself, accordingly, will not know what is there in the external page.
And just when you connect the script, it has full access to everything, like a native. And here it makes no sense to put spokes in the wheels. If you disable cookies, then in theory the script will still be able to read them if they are somehow reflected on the page. For example, the page has a "Hello %username%" test, and the script has access to the DOM so it can parse the name and other variables. It makes more sense to split on an all-or-nothing basis or a hard-coded API.