Cross-application scripting

Cross-application scripting (CAS) is a vulnerability affecting desktop applications that don't check input in an exhaustive way. CAS allows an attacker to insert data that modifies the behaviour of a particular desktop application. This makes it possible to extract data from inside of the users' systems. Attackers may gain the full privileges of the attacked application when exploiting CAS vulnerabilities; the attack is to some degree independent of the underlying operating system and hardware architecture.
Initially discovered by Emanuele Gentili and presented with two other researchers (Alessandro Scoscia and Emanuele Acri) that had participated in the study of the technique and its implications, it was presented for the first time during the Security Summit 2010 in <a href="/facts/Milan/0xrtbPdt">Milan</a>.
The <a href="/facts/Format_string_attack/hBvaxceE">format string attack</a> is very similar in concept to this attack and CAS could be considered as a generalization of this attack method. Some aspects of this technique have been previously demonstrated in <a href="/facts/Clickjacking/47eJFpHb">clickjacking</a> techniques.

Cross-application scripting open-in-new

Cross-application scripting