Client Side Vulnerabilities / JavaScript Injection (DOM-Based)

Description

JavaScript injection (DOM-based) is a type of Client Side Vulnerability (CWE-79) which allows attackers to inject malicious JavaScript code into a web application. This code is executed by the user’s browser and can be used to manipulate the web application. The OWASP Testing Guide describes JavaScript Injection as “a form of attack that exploits vulnerabilities in Web-based applications that rely on JavaScript for their functionality, particularly those that allow user supplied input to control the application’s behavior.”

Risk

This vulnerability can be extremely dangerous as it allows attackers to completely control the functionality of vulnerable applications. Additionally, it can be difficult to detect and, if left unchecked, can result in data breaches and other malicious actions.

Solution

The primary solution to this vulnerability is to sanitize user-supplied input and to include a Content Security Policy (CSP) on the web application. Sanitizing user-supplied input ensures that any potentially malicious code is removed before it is used in the web application. Additionally, a CSP can be used to restrict which JavaScript can be executed by the browser.