News for hackers. Stuff that matters.

A comment on Harvesting credit card numbers and passwords from websites. Parent comment

Re:Harvesting credit card numbers and passwords from websites by bubble_boi on Saturday January 06, 2018 @07:08PM (#16088249)
Author here. Someone in a comment pointed out that you if you could get your code in express middleware (or something depended on by express middleware or similar) you could potentially alter any CSP header in the responses (if it's set in middleware before your's in the chain).
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by tlrobinson on Sunday January 07, 2018 @06:56AM (#16090505)
Indeed. Then the middleware could also inject exfiltration JavaScript in `text/html` or `application/javascript` responses, which would work even if the app doesn’t use npm modules on the frontend.

This applies to almost any backend web framework and package manager, but the culture of micro packages in npm suits itself well to this attack.

[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by tlrobinson on Sunday January 07, 2018 @07:09AM (#16090553)
Clearly what we need is cryptographically-signed JavaScript and CSP pinning.

(I’m only half joking)

EDIT: oh, CSP pinning is actually a thing that’s been proposed https://www.w3.org/TR/csp-pinning/

[ Parent | on HN ]