DOM Clobbering Summary

Research Questions

1/ Are there other way of DOM clobbering gadegts besides window and document lookups.

Can we clobber the lookups besides the window and document objects?

E.g. This post talks about an interesting feature of form element, which is called "form clobbering".

Unlike first-order clobbering, where we clobber a place using window.target, form clobbering appears to be a form of second-order clobbering. This involves altering the behavior of an existing reference to DOM elements (the reference of form is intended) within the JavaScript program.

<form id=x target="_blank"></form>
<input form=x id="target">

<script>alert(x.target)</script> // [object HTMLInputElement]

Follows the writing style used in The Great Request Robbery paper Section 4.

2/ DOM Nodes2String Type Conversion

Unlike traditional taint-style vulnerabilities, in the context of dom clobbering, attackers inject HTML markups in the form of DOM node types during initial loading through DOM-clobberable sources, attackers must leverage toString operations to convert DOM node types into strings or other primitive types that can flow to sink functions. toString operations generally occur in two ways:

1. Implicit toString call during type coercion, which can access the href attributes of <a> and <area> tags.
2. Property lookups that access corresponding DOM node attributes, such as obj.value which retrieves the value attribute from injected DOM nodes obj.