{"id":"https://openalex.org/W2990146523","doi":"https://doi.org/10.1145/3320269.3384744","title":"XSS Vulnerabilities in Cloud-Application Add-Ons","display_name":"XSS Vulnerabilities in Cloud-Application Add-Ons","publication_year":2020,"publication_date":"2020-10-05","ids":{"openalex":"https://openalex.org/W2990146523","doi":"https://doi.org/10.1145/3320269.3384744","mag":"2990146523"},"language":"en","primary_location":{"id":"doi:10.1145/3320269.3384744","doi":"https://doi.org/10.1145/3320269.3384744","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3320269.3384744","pdf_url":null,"source":{"id":"https://openalex.org/S4363609011","display_name":"ACM Asia Conference on Computer and Communications Security (ASIA CCS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/1911.12332","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5018917918","display_name":"Thanh Bui","orcid":"https://orcid.org/0000-0002-5137-8551","observed_orcids":["https://orcid.org/0000-0002-5137-8551"]},"institutions":[{"id":"https://openalex.org/I9927081","display_name":"Aalto University","ror":"https://ror.org/020hwjq30","country_code":"FI","type":"education","lineage":["https://openalex.org/I9927081"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Thanh Bui","raw_affiliation_strings":["Aalto University, Espoo, Finland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aalto University, Espoo, Finland","institution_ids":["https://openalex.org/I9927081"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061196553","display_name":"Siddharth Prakash Rao","orcid":"https://orcid.org/0000-0001-8656-1877","observed_orcids":["https://orcid.org/0000-0001-8656-1877"]},"institutions":[{"id":"https://openalex.org/I9927081","display_name":"Aalto University","ror":"https://ror.org/020hwjq30","country_code":"FI","type":"education","lineage":["https://openalex.org/I9927081"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Siddharth Rao","raw_affiliation_strings":["Aalto University, Espoo, Finland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aalto University, Espoo, Finland","institution_ids":["https://openalex.org/I9927081"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005295563","display_name":"Markku Antikainen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9927081","display_name":"Aalto University","ror":"https://ror.org/020hwjq30","country_code":"FI","type":"education","lineage":["https://openalex.org/I9927081"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Markku Antikainen","raw_affiliation_strings":["Aalto University, Espoo, Finland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aalto University, Espoo, Finland","institution_ids":["https://openalex.org/I9927081"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030176989","display_name":"Tuomas Aura","orcid":"https://orcid.org/0000-0003-1648-8875","observed_orcids":["https://orcid.org/0000-0003-1648-8875"]},"institutions":[{"id":"https://openalex.org/I9927081","display_name":"Aalto University","ror":"https://ror.org/020hwjq30","country_code":"FI","type":"education","lineage":["https://openalex.org/I9927081"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Tuomas Aura","raw_affiliation_strings":["Aalto University, Espoo, Finland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aalto University, Espoo, Finland","institution_ids":["https://openalex.org/I9927081"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I9927081"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":93},"biblio":{"volume":null,"issue":null,"first_page":"610","last_page":"621"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0013000000035390258,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"cross-site scripting","score":0.9980000257492065},{"id":"https://openalex.org/keywords/software-security","display_name":"software security","score":0.5189999938011169},{"id":"https://openalex.org/keywords/google-workspace","display_name":"Google Workspace","score":0.6869999766349792},{"id":"https://openalex.org/keywords/shopify","display_name":"Shopify","score":0.9779999852180481},{"id":"https://openalex.org/keywords/client-side-javascript","display_name":"client-side JavaScript","score":0.7630000114440918},{"id":"https://openalex.org/keywords/document-sharing","display_name":"document sharing","score":0.6510000228881836},{"id":"https://openalex.org/keywords/vulnerability-reduction","display_name":"vulnerability reduction","score":0.6449999809265137}],"concepts":[{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.9631282091140747},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7947258949279785},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.7679365873336792},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.725499153137207},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6226244568824768},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.6010357141494751},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.5543609261512756},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.5192378163337708},{"id":"https://openalex.org/C2778505942","wikidata":"https://www.wikidata.org/wiki/Q18344624","display_name":"Microservices","level":3,"score":0.5077791810035706},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4479401707649231},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.3279038667678833},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.19200199842453003},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.18060460686683655},{"id":"https://openalex.org/C79373723","wikidata":"https://www.wikidata.org/wiki/Q386275","display_name":"Web development","level":3,"score":0.14043718576431274},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1145/3320269.3384744","doi":"https://doi.org/10.1145/3320269.3384744","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3320269.3384744","pdf_url":null,"source":{"id":"https://openalex.org/S4363609011","display_name":"ACM Asia Conference on Computer and Communications Security (ASIA CCS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:1911.12332","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/1911.12332","pdf_url":"https://arxiv.org/pdf/1911.12332","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"mag:2990146523","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/pdf/1911.12332v1","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"arXiv (Cornell University)","raw_type":null},{"id":"pmh:oai:aaltodoc.aalto.fi:123456789/114185","doi":null,"is_oa":true,"landing_page_url":"https://aaltodoc.aalto.fi/handle/123456789/114185","pdf_url":null,"source":{"id":"https://openalex.org/S4306401662","display_name":"Aaltodoc (Aalto University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I9927081","host_organization_name":"Aalto University","host_organization_lineage":["https://openalex.org/I9927081"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"},{"id":"doi:10.48550/arxiv.1911.12332","doi":"https://doi.org/10.48550/arxiv.1911.12332","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.1911.12332","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:1911.12332","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/1911.12332","pdf_url":"https://arxiv.org/pdf/1911.12332","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2990146523.pdf","grobid_xml":"https://content.openalex.org/works/W2990146523.grobid-xml"},"referenced_works_count":28,"referenced_works":["https://openalex.org/W74184291","https://openalex.org/W197713628","https://openalex.org/W1222699389","https://openalex.org/W1438425488","https://openalex.org/W1492437080","https://openalex.org/W1543478129","https://openalex.org/W1561387739","https://openalex.org/W1598325486","https://openalex.org/W1663388364","https://openalex.org/W1887482550","https://openalex.org/W1974977720","https://openalex.org/W1991074244","https://openalex.org/W2038841294","https://openalex.org/W2046529117","https://openalex.org/W2108810805","https://openalex.org/W2112995928","https://openalex.org/W2134646643","https://openalex.org/W2148211687","https://openalex.org/W2162316255","https://openalex.org/W2170920217","https://openalex.org/W2189652372","https://openalex.org/W2336650211","https://openalex.org/W2405282478","https://openalex.org/W2771281827","https://openalex.org/W2790761820","https://openalex.org/W2901089484","https://openalex.org/W2961937997","https://openalex.org/W4252443823"],"related_works":["https://openalex.org/W6983495488","https://openalex.org/W2911684607","https://openalex.org/W2289268239","https://openalex.org/W2261492775","https://openalex.org/W162914106","https://openalex.org/W4400913595","https://openalex.org/W2465737833","https://openalex.org/W2472340848","https://openalex.org/W1969295446","https://openalex.org/W2405517096"],"abstract_inverted_index":{"Many":[0],"cloud-application":[1],"vendors":[2],"open":[3],"their":[4,15],"APIs":[5,22],"for":[6,133],"third-party":[7],"developers":[8],"to":[9,85,104,108,170],"easily":[10],"extend":[11],"the":[12,41,55,62,95,101,118,158,167,173,181],"functionality":[13],"of":[14,54,80,94,100,151,160],"applications.":[16],"The":[17,89,110],"features":[18,99],"implemented":[19],"with":[20],"these":[21],"are":[23,83],"called":[24,27],"add-ons":[25,56,82,112,132,153],"(also":[26],"add-ins":[28],"or":[29],"apps).":[30],"This":[31],"is":[32],"a":[33,124,148],"relatively":[34],"new":[35],"phenomenon,":[36],"and":[37,97,144,146,179],"its":[38],"effects":[39],"on":[40],"application":[42,136],"security":[43,71],"have":[44,57],"not":[45],"been":[46],"widely":[47],"studied.":[48],"It":[49],"seems":[50],"likely":[51],"that":[52,78],"some":[53],"lower":[58],"code":[59],"quality":[60],"than":[61],"core":[63],"applications":[64,103],"themselves":[65],"and,":[66],"thus,":[67],"may":[68],"bring":[69],"in":[70],"vulnerabilities.":[72],"In":[73,123],"this":[74,161],"work,":[75],"we":[76,128],"found":[77],"many":[79],"such":[81],"vulnerable":[84,111,152],"cross-site":[86],"scripting":[87],"(XSS).":[88],"attacker":[90],"can":[91,176,183],"take":[92],"advantage":[93],"document-sharing":[96],"messaging":[98],"cloud":[102],"send":[105],"malicious":[106,121],"input":[107],"them.":[109,155],"then":[113],"execute":[114],"client-side":[115],"JavaScript":[116],"from":[117],"carefully":[119],"crafted":[120],"input.":[122],"major":[125],"analysis":[126],"effort,":[127],"systematically":[129],"studied":[130],"300":[131],"three":[134],"popular":[135],"suites,":[137],"namely":[138],"Microsoft":[139],"Office":[140],"Online,":[141],"G":[142],"Suite":[143],"Shopify,":[145],"discovered":[147],"significant":[149],"percentage":[150],"among":[154],"We":[156],"present":[157],"results":[159],"study,":[162],"as":[163,165],"well":[164],"analyze":[166],"add-on":[168],"architectures":[169],"understand":[171],"how":[172,180],"XSS":[174],"vulnerabilities":[175],"be":[177,184],"exploited":[178],"threat":[182],"mitigated.":[185]},"counts_by_year":[{"year":2024,"cited_by_count":1}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2019-12-05T00:00:00"}