The Danger of Convenience: Unveiling the Explosively Amplified Security Risks Posed by Third-Party JavaScript Inclusion and Caching

Abstract

Today’s web applications feature the proliferation of third-party JavaScript inclusion, which incurs a range of security risks. Although attack strategies by manipulating third-party JavaScript files have been widely investigated, the adverse impact caused by third-party JavaScript inclusion and caching does not receive much attention. Specifically, when a malicious script is cached, it can revive and bite every time when a user visits any website that includes it, leading to a much worse effect of the attack. In this article, we present the first comprehensive study on Alexa top-1 million websites to investigate how likely third-party JavaScript inclusion and caching can make an attack large-scale and long-lasting, and further uncover insecure practices that carelessly or inadvertently exacerbate the attack impact. We develop a customized toolkit on top of Chromium and build three tree structures to capture the complex inclusion relationships between websites and third-party JavaScript files. Meanwhile, we propose a time bounding technique to accurately estimate the caching duration of a JavaScript file. The results of our study reveal that a large number of websites overlook the adverse impact and are careless about the third-party JavaScript inclusion and caching control settings. We also discuss potential solutions to improve the current practices to minimize the security risk associated with third-party JavaScript inclusion and caching.