AJAX Apps Ripe Targets for JavaScript Hijacking (
Page 1 of 3 )
A pervasive vulnerability that allows an attacker to take over any Web browser and silently intercept sensitive data input occurs in Web 2.0 settings from Yahoo to ASP .Net to Google, security firm Fortify says.Fortify Software has documented what the security firm is calling a "pervasive and critical" vulnerability in Web 2.0 applications—specifically, in the ability of an attacker to use a JavaScript vulnerability to steal critical data by emulating unsuspecting users.
The vulnerability—which allows an exploit called JavaScript Hijacking—can be found in the biggest AJAX frameworks out there, including three server-integrated toolkits: Microsoft ASP.Net AJAX (aka Atlas), Google Web Toolkit and xajax—the last of which is an open-source PHP-class library implementation of AJAX.
Client-side libraries that Fortify inspected and found to be vulnerable are the Yahoo UI, Prototype, Script.aculo.us, Dojo, Moo.fx, jQuery, Rico and MochiKit.
Of the AJAX frameworks and client-side libraries Fortify inspected, only DWR 2.0 (Direct Web Remoting 2.0) has mechanisms to prevent JavaScript Hijacking.
That isnt surprising, given that Joe Walker, who developed DWR, wrote about the JavaScript Hijacking flaw in early March.
According to Fortify, the other AJAX frameworks dont explicitly provide any protection, nor do their documentation materials mention the vulnerability as a security concern.
Brian Chess, Fortify Softwares co-founder and Chief Scientist, told eWEEK that the security firm is getting a ho-hum reaction from some regarding the news, since JavaScript has never been considered to be safe anyway.
"Everybody hears, Oh, theres a JavaScript security problem, and everybody says, Oh yeah, everybody knows JavaScript is a security concern in itself," Chess said.
This, however, is the first type of JavaScript problem that Chess knows of that specifically targets AJAX-style and Web 2.0-style applications, he said.
Click here to read more about JavaScript security concerns.
Whats happening, Chess said, is that AJAX-style applications are dropping the X off of AJAX, which stands for Asynchronous JavaScript and XML. Thus, the applications are doing all their work in JavaScript, particularly using it as their data transport format.
The gotcha is that Web browsers dont protect JavaScript as they do HTML or other protocols they transport. This allows rogue hackers to get hold of sensitive data that most developers think theyve protected, Chess said.
"The attacker can put code in a Web page," he said. "If he can trick you into running it in your browser, your browser can look like you and act like you, but its not you; its actually shoveling data back to [the attacker]."
The problem specifically lies in JSON (JavaScript Object Notation), a lightweight data interchange format that for some time has been known to have security problems.
The text-based, human-readable format for representing objects and other data structures is mostly used to transmit structured data over a network connection.
Yahoo began offering some of its Web Services optionally in JSON in December 2005, and Google started offering JSON feeds for its GData Web protocol in December 2006.
Next Page: Finding a way in.
Network Security & Hardware 
/ 1 
