3 ms·
It's easy to overlook the fact that the act of parsing structured input is equivalent to executing code in a VM, and in many cases it can lead to the same class
by ithkuil 9y ago
It's easy to overlook the fact that the act of parsing structured input is equivalent to executing code in a VM, and in many cases it can lead to the same class of issues that running code can, especially side channel attacks.
- infogulch 9y agoI have never considered parsing to be equivalent to executing a VM. Does this mean that if you found the right gadgets in the implementation of JSON.parse you could attack a browser just with that?
- Xylakant 9y agoI'm not aware of an instance where browsers were attacked via that vector, but for example Ruby On Rails was vulnerable to attacks via the JSON Parser: https://www.exploit-db.com/exploits/24434/ https://www.exploit-db.com/exploits/24434/ (many other frameworks too, I'm just picking this one because I'm familiar with it)