DOM-XSS Detection via Webpage Interaction Fuzzing and URL Component Synthesis

DOM-XSS Detection via Webpage Interaction Fuzzing and URL Component Synthesis

Speakers: Nuno Sabino

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=3w7Rq0ZP3KM

Overview

This research significantly advances DOM-based XSS detection at scale by addressing the fundamental code coverage limitations of prior work. While previous studies relied on passive navigation (loading a page and waiting for code to execute), this work introduces two active exploration techniques: webpage interaction fuzzing (simulating realistic user interactions to trigger event handlers) and dynamic symbolic execution (DSE) for URL component synthesis (generating GET parameters and fragment values that trigger new code paths).

Evaluated on ~44,000 pages from popular domains, the fuzzer discovers 21% more DOM XSS vulnerabilities than passive navigation, and DSE contributes additional unique flows that fuzzing alone cannot find. The work also reveals an encouraging trend: DOM XSS prevalence has declined by nearly two orders of magnitude in confirmed flows per thousand pages compared to prior studies from 2014-2020.

Background

▶ Watch: DOM XSS remains most reported web vulnerability despite defenses (0:00)

DOM-based XSS vulnerabilities sit entirely in client-side code, where attacker-controlled URL components (parameters, fragments) flow through JavaScript to sensitive sinks (eval, innerHTML, etc.). Despite over a decade of research and defenses (CSP, Trusted Types, WAFs), DOM XSS remains the most frequently reported web vulnerability type. Prior large-scale studies (25 Million Flows, Doomsday, TalkGen) used taint tracking in modified browsers to detect flows, but were limited to passive navigation -- loading pages without interacting with them, missing vulnerabilities gated behind event handlers or specific URL parameters.

Key Findings

▶ Watch: Taint tracking methodology and confirmation via payload synthesis (4:00)

• Fuzzing discovers 21% more DOM XSS than passive navigation, finding a superset of passive flows plus 15 additional unique flows
• DSE rediscovers 26% of parameter-dependent flows and finds 10 unique vulnerabilities in pages without known issues
• Realistic simulation of 55 event handler types through high-level action mapping, avoiding false positives from indiscriminate event triggering
• Two orders of magnitude reduction in confirmed DOM XSS flows per thousand pages compared to 2014-2017 studies
• CSP remains improperly configured by developers; Trusted Types still depend on correct sanitizer placement; WAFs miss URL fragment-based injection entirely

Technical Deep Dive

▶ Watch: Fuzzing: 55 event handler types mapped to realistic high-level actions (6:00)

Fuzzing methodology: Static analysis collects event handlers and associated DOM elements, then maps each handler to high-level actions (mouse clicks, key presses, drag-and-drop sequences). The fuzzer mutates and combines these actions to simulate realistic user interactions. Supporting 55 event handler types ensures broad coverage while maintaining realism (avoiding false positives from triggering impossible user interactions).

Dynamic Symbolic Execution (DSE): URL components (GET parameters, fragment values) are represented as concolic variables. During page execution, conditional path constraints are collected. Z3 solver negates constraints to generate alternative URLs that trigger new code paths. Source-to-source JavaScript rewriting adds symbolic execution logic, with a 24-hour timeout per page.

Taint tracking uses a modified Chromium browser to detect flows from tainted sources (URL components) to sensitive sinks. Confirmation follows Doomsday's methodology: synthesizing a URL with payload and verifying that the payload reaches the sink unmodified. Five runs of each condition mitigate non-determinism.

Demo / Proof of Concept

▶ Watch: Results: 21% more DOM XSS from fuzzing, unique flows from DSE (10:00)

~44,000 pages from popular domains analyzed. Passive analysis replicated prior work (Doomsday, TalkGen) on modern Chromium. Fuzzer condition added interaction-based exploration. DSE condition added URL parameter synthesis. Results show consistent improvement from each technique, with both contributing unique vulnerability discoveries.

Defensive Implications

▶ Watch: DOM XSS prevalence declined 100x compared to prior studies (12:00)

The declining DOM XSS prevalence (two orders of magnitude reduction) suggests that defenses and developer awareness are improving. However, vulnerabilities still exist in popular pages, and many are only discoverable through active interaction (event handlers) or specific URL parameters that passive scanning misses. Security teams should use active fuzzing approaches rather than passive scanning for DOM XSS assessments.

Key Takeaways

• Webpage interaction fuzzing discovers 21% more DOM XSS than passive navigation through realistic simulation of 55 event handler types
• Dynamic symbolic execution synthesizes URL parameters that trigger hidden vulnerability code paths
• DOM XSS prevalence has declined ~100x compared to 2014-2017 studies, but vulnerabilities persist in popular sites
• Passive-only analysis misses vulnerabilities behind event handlers and parameter-dependent code paths
• Current defenses (CSP, Trusted Types, WAFs) remain improperly deployed or easily bypassed
• Both fuzzing and DSE contribute unique vulnerability discoveries not found by the other technique

About the Speaker(s)

Nuno Sabino recently graduated from Carnegie Mellon University and is currently on the job market. The research focuses on web security, DOM XSS detection, and dynamic analysis techniques for client-side security.