Client-side JavaScript frameworks bring a lot of functionality and logic to the front-end. With all this code running in the browser, do they impose extra risks to the applications? Frameworks like AngularJS incorporate many security features like context-aware encoding and CSRF protection, but they also leave gaps and traps in which developers may fall when putting too much trust into client side code. In this presentation we will look at the security controls provided by the AngularJS framework out of the box and the security defects that still reside in the Angular code and available plugins. Attendees will see demonstrations of several attacks, such as a DOM-XSS, a template injection, and a sandbox bypass.
About Ksenia Dmitrieva-Peguero
Ksenia Dmitrieva-Peguero is a Principal Consultant at Cigital with seven years of experience in application security and five years of software development experience. She performed numerous penetration tests, code reviews, and architecture analysis engagements for clients in financial services, entertainment, telecommunications, energy, and enterprise security industries. Her current concentration is on analyzing JavaScript frameworks and HTML5 technologies, researching their security implications, vulnerability discovery and remediation. Ms. Dmitrieva-Peguero has delivered presentations and trainings at conferences around the world, including BSides Security in London, Nullcon in India, AppSec California in the USA, RSA Asia Pacific & Japan in Singapore, and AppSec Europe in Italy.
Ksenia holds a M.S. in Computer Science and is currently pursuing her Ph.D. at George Washington University.
