Browser Logic Errors & XS-Leaks with Jorian Woltjer (Ep. 193)

[BLUF]
This episode features security researcher Jorian Walter discussing advanced client-side exploitation techniques, including a novel Cross-Site Leak (CSL) bypass using Service Workers 1:06, methods to stop redirects for OAUTH code interception 36:50, and new vulnerabilities in declarative partial updates 25:00.

Key Takeaways:
• Jorian Walter introduces a technique to revive Cross-Site Leaks by using a Service Worker to intercept requests and modify the fetch-dest header, effectively bypassing Chrome's Origin-Block-Response (OBR) restrictions that normally block script loading probes 26:10.
• He details several methods to prevent redirects from overriding JavaScript execution, such as exploiting URL length limits 37:50 and using window.navigation.entries to leak URLs from null-origin error pages 43:40.
• A new DNS rebinding bypass is discussed, which utilizes window navigation throttling to bypass Local Network Access (LNA) protections, allowing access to local services like IoT devices 59:40.
• Walter explains a "pop-under" technique using the compromised password notification to force focus back to a main window, hiding a malicious popup behind it for clickjacking attacks 16:30.
• The episode highlights vulnerabilities in the new "Declarative Partial Updates" HTML feature, specifically how template tags can be used to bypass sanitizers like DOMPurify by injecting content after initial parsing 25:00.
• A bypass for DOMPurify is shown using the <select-content> element, which clones options into the preview, allowing XSS payloads to be reinserted after the sanitizer has already processed them 38:10.

These techniques demonstrate how subtle browser behaviors and recent HTML spec changes can be chained to bypass security controls and extract sensitive data.

Sources:

• 1:06 Overview of Cache Key Injection research by Bruins at Defcon.
• 26:10 Explanation of the Service Worker fetch-dest header bypass for Cross-Site Leaks.
• 36:50 Techniques for stopping redirects to intercept OAUTH codes.
• 43:40 Using navigation.entries to access null-origin URLs.
• 59:40 DNS rebinding bypass using navigation throttling.
• 16:30 Pop-under technique using compromised password notifications.
• 25:00 Vulnerabilities in Declarative Partial Updates and template tags.
• 38:10 DOMPurify bypass via <select-content> cloning.