Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web

Authors: 

Marco Squarcina, Mauro Tempesta, and Lorenzo Veronese, TU Wien; Stefano Calzavara, Università Ca' Foscari Venezia & OWASP; Matteo Maffei, TU Wien

Abstract: 

Related-domain attackers control a sibling domain of their target web application, e.g., as the result of a subdomain takeover. Despite their additional power over traditional web attackers, related-domain attackers received only limited attention from the research community. In this paper we define and quantify for the first time the threats that related-domain attackers pose to web application security. In particular, we first clarify the capabilities that related-domain attackers can acquire through different attack vectors, showing that different instances of the related-domain attacker concept are worth attention. We then study how these capabilities can be abused to compromise web application security by focusing on different angles, including cookies, CSP, CORS, postMessage, and domain relaxation. By building on this framework, we report on a large-scale security measurement on the top 50k domains from the Tranco list that led to the discovery of vulnerabilities in 887 sites, where we quantified the threats posed by related-domain attackers to popular web applications.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {274703,
author = {Marco Squarcina and Mauro Tempesta and Lorenzo Veronese and Stefano Calzavara and Matteo Maffei},
title = {Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web},
booktitle = {30th {USENIX} Security Symposium ({USENIX} Security 21)},
year = {2021},
isbn = {978-1-939133-24-3},
pages = {2917--2934},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/squarcina},
publisher = {{USENIX} Association},
month = aug,
}

Presentation Video