For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kohli9harjeev's avatar
kohli9harjeev
Icon for Nimbostratus rankNimbostratus
Mar 30, 2017

Protection of XSSJacking

Hi Guys

 

New Attack Called “XSSJacking” Discovered That Combined of Clickjacking, Pastejacking and Self-XSS Attacks

 

Does anyone knows any resolution to this vulnerability using ASM ? Or Protection with XSS ,Clickjacking will be sufficient to resolve it

 

Regards

 

application delivery
ASM Advanced WAF
BIG-IP

2 Replies

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Mar 30, 2017

    The name "XSSJacking" has been coined only a few days ago by researcher Dylan Ayrey. The attack is a combination of XSS, ClickJacking and CSRF - all these attacks are mitigated by F5 ASM individually and together.

     

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Apr 02, 2017

    PasteJacking is a CLIENT-side attack where malicious site tricks the user to copy some text, then the malicious JavaScript code replaces the contents of the copied text in the clipboard with a malicious XSS payloads.The malicious site then ASKs the user to paste it. Because it is a CLIENT-side attack starting on a MALICIOUS site (not protected by ASM) Pastejacking cannot be stopped as it happens in memory of user's BROWSER. However when the user pastes the XSS payload to a legitimate site (protected by ASM) ASM will DETECT the XSS in the input (provided the policy is configured correctly to detect and block XSS).