4 ms·
JSON is very widely used, so if it’s properties were bad for security, we should expect different JSON-based attacks popping up every week, right? How often do
by throwaway894345 5y ago
JSON is very widely used, so if it’s properties were bad for security, we should expect different JSON-based attacks popping up every week, right? How often do we see these kinds of attacks?
- patrec 5y agoIt's not hard to find quite recent json parsing vulnerabilities, e.g. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-b... A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json Here is a nice blog post walking through various JSON based exploits: https://bishopfox.com/blog/json-interoperability-vulnerabilities https://bishopfox.com/blog/json-interoperability-vulnerabili...
- throwaway894345 5y agoInteresting. I haven’t talk heard of any of those.