CWE-830 covers a product that includes web functionality, such as a widget, from another domain. Once included, that code operates within the domain of your product and can potentially get total access and control of it.
It affects web based products and web servers, and is common in mashup style pages that stitch together content from several domains.
How it happens
A JavaScript widget is added with a script tag that points at another host. The browser runs that script as if it were your own. It can read the page, read cookies that are not protected, change forms and send data anywhere.
<!-- Vulnerable pattern: runs in your origin, controlled by someone else -->
<script src="https://widgets.example.net/chat.js"></script>
MITRE stresses that even a trusted third party is a risk. If that source is compromised, or if the code is modified in transit, your product is exposed to the attack as well.
What an attacker gains
The record lists execution of unauthorized code or commands, with impact on confidentiality, integrity and availability. In practice that means session theft, page defacement, silent form capture and redirection of users.
How to find it
The record lists no detection methods. A practical review is quick. Open your pages with browser developer tools and list every external host that serves scripts, frames or styles. Search templates for script tags with remote sources. Ask who owns each one and what happens if it is compromised.
How to fix it
MITRE lists no formal mitigations. Common defenses:
- Include as little third party code as you can, and remove what is not needed.
- Host a reviewed copy of a script yourself instead of loading it live.
- Use Subresource Integrity so the browser refuses a file whose hash changed.
- Add a Content Security Policy that limits which origins may serve scripts.
- Put untrusted widgets in a sandboxed iframe so they do not share your origin.
<script src="https://cdn.example.com/lib.min.js"
integrity="sha384-REPLACE_WITH_REAL_HASH"
crossorigin="anonymous"></script>
Click through it at your own pace, or open it full screen.
Quick check
Why does a script tag from another domain have so much power?
The browser runs it in the including page's origin. It has the same access to the page as your own code.
Does Subresource Integrity help if the vendor is breached?
Yes for file changes. A modified file no longer matches the hash and is blocked. You then update the hash after reviewing the new version.
