JSON Hijacking - vulnerability in some GET situations

http://haacked.com/archive/2009/06/25/json-hijacking.aspx

by FluidDjango • 17 years ago

9 4 17 years ago

haacked.com

tptacek• 17 years ago

This is Stephan Di Paola's "Prototype Hijacking" attack, and it's more than 2 years old. We wrote it up here:

http://www.matasano.com/log/672/di-paolas-prototype-injectio...

int2e2• 17 years ago

Yeah, XSSI has been well known for a while.

This article's argument against using custom headers is a bit bunk. If you're not properly disabling proxy caching for sensitive data, you're asking for trouble anyways. Disabling caching properly is a bit tricky, but there are some useful details here: http://code.google.com/p/browsersec/wiki/Part2#Document_cach...

int2e2• 17 years ago

Perhaps there are some interesting corner-cases where the browser will locally cache the JSON. Time to go play with it...

sh1mmer• 17 years ago

For some more practical advice, this is the point of using crumbs, kids.

If you pass a unique verifiable value with your request you can avoid this sort of thing. This is also true of any GET request that can change user data (which you shouldn't be doing anyway).

A typical way to do this is to hash some secret for the user with a salt and a timestamp. The timestamp and the secret are passed with the request and can be used to verify the secret.

JSON Hijacking - vulnerability in some GET situations

Related Stories