4 ms·

Does anyone know what browsers allow you to override the Array constructor? I was under the impression that modern browsers don't.

by andreyf 13y ago

pygy_ 13y ago
If the attacker knows the structure of the reply, `__defineSetter__` can be used to extract the JSON content as well. From [0]: <script type="text/javascript"> Object.prototype.__defineSetter__('Id', function(obj){alert(obj);}); </script> <script src="http://example.com/Home/AdminBalances">/*Boom*/</script> [0]: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ http://haacked.com/archive/2009/06/25/json-hijacking.aspx/
- Jare 13y ago
  ES4 requires using the original, unmodified bindings. From a comment: http://stackoverflow.com/questions/16289894/is-json-hijacking-still-an-issue-in-modern-browsers/16880162#16880162 http://stackoverflow.com/questions/16289894/is-json-hijackin...
- primaryobjects 13y ago
  That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome. Example http://jsfiddle.net/V53BL http://jsfiddle.net/V53BL
  - madeofpalk 13y ago
    I can't get this to work with an actual API call. <script> Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)}); var trigger = [{"user":{}}]; </script> <script id='current-user' src="http://my.secretapi.com/users/current"></script> Where the API returns something like [{'user':{'name':'Joe Bloggs'}}] (Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?
    - primaryobjects 13y ago
      It works on an explicit set, but not on initialization of the object. So: var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response. x.user = "wow"; This will trigger, however.
      - gsnedders 13y ago
        And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.
- gsnedders 13y ago
  No current browser should be vulnerable to this (ES5 requires object literals use [[DefineOwnProperty]], not [[Put]], and hence no setter on the prototype chain should be called). I believe all browsers have since fixed this.
matchu 13y ago
Here's a quick fiddle to check. This trick doesn't seem to work on Chrome 31. http://jsfiddle.net/g9R5s/ http://jsfiddle.net/g9R5s/
aboodman 13y ago
I do not think this particular attack works in any modern browser anymore. However, the while (1); (or similar tricks) is an easy defense-in-depth measure in case browsers regress in this area or new attacks are found.

Does anyone know what browsers allow you to override the Array constructor? I was under the impression that modern browsers don't.

by andreyf 13y ago

Does anyone know what browsers allow you to override the Array constructor? I was under the impression that modern browsers don't.

pygy_ 13y ago

If the attacker knows the structure of the reply, `__defineSetter__` can be used to extract the JSON content as well. From [0]: <script type="text/javascript"> Object.prototype.__defineSetter__('Id', function(obj){alert(obj);}); </script> <script src="http://example.com/Home/AdminBalances">/*Boom*/</script> [0]: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ http://haacked.com/archive/2009/06/25/json-hijacking.aspx/

Jare 13y ago
ES4 requires using the original, unmodified bindings. From a comment: http://stackoverflow.com/questions/16289894/is-json-hijacking-still-an-issue-in-modern-browsers/16880162#16880162 http://stackoverflow.com/questions/16289894/is-json-hijackin...
primaryobjects 13y ago
That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome. Example http://jsfiddle.net/V53BL http://jsfiddle.net/V53BL
- madeofpalk 13y ago
  I can't get this to work with an actual API call. <script> Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)}); var trigger = [{"user":{}}]; </script> <script id='current-user' src="http://my.secretapi.com/users/current"></script> Where the API returns something like [{'user':{'name':'Joe Bloggs'}}] (Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?
  - primaryobjects 13y ago
    It works on an explicit set, but not on initialization of the object. So: var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response. x.user = "wow"; This will trigger, however.
    - gsnedders 13y ago
      And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.
gsnedders 13y ago
No current browser should be vulnerable to this (ES5 requires object literals use [[DefineOwnProperty]], not [[Put]], and hence no setter on the prototype chain should be called). I believe all browsers have since fixed this.

matchu 13y ago

Here's a quick fiddle to check. This trick doesn't seem to work on Chrome 31. http://jsfiddle.net/g9R5s/ http://jsfiddle.net/g9R5s/

aboodman 13y ago

I do not think this particular attack works in any modern browser anymore. However, the while (1); (or similar tricks) is an easy defense-in-depth measure in case browsers regress in this area or new attacks are found.