Adobe Flex 3: DOM-Based XSS Risk Due To JavaScript Manipulation

Jun 24, 2008 •

Anthony Pell

1 min read

Topics Covered

security advisory vulnerability javascript dom-based xss adobe flex code manipulation

We recently researched an interesting DOM-based XSS vulnerability in Adobe Flex 3 applications that exploits a scenario in which two frames (parent & son) interact with each other, without properly validating their execution environment.

In our research, we have seen that in some cases, it is possible to manipulate JavaScript code flow, by controlling the environment in which it runs. Specifically, we managed to return hacker-controlled boolean values to conditional statements, and by that force the application to be vulnerable to an existing DOM-based XSS, which was otherwise unexploitable.

The link for this article located at wfblog is no longer available.