4 ms·

If the attacker knows the structure of the reply, `defineSetter` can be used to extract the JSON content as well. From [0]: <script type="text/java

by pygy_ 13y ago

If the attacker knows the structure of the reply, `__defineSetter__` can be used to extract the JSON content as well. From [0]: <script type="text/javascript"> Object.prototype.__defineSetter__('Id', function(obj){alert(obj);}); </script> <script src="http://example.com/Home/AdminBalances">/*Boom*/</script> [0]: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ http://haacked.com/archive/2009/06/25/json-hijacking.aspx/

Jare 13y ago
ES4 requires using the original, unmodified bindings. From a comment: http://stackoverflow.com/questions/16289894/is-json-hijacking-still-an-issue-in-modern-browsers/16880162#16880162 http://stackoverflow.com/questions/16289894/is-json-hijackin...
primaryobjects 13y ago
That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome. Example http://jsfiddle.net/V53BL http://jsfiddle.net/V53BL
- madeofpalk 13y ago
  I can't get this to work with an actual API call. <script> Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)}); var trigger = [{"user":{}}]; </script> <script id='current-user' src="http://my.secretapi.com/users/current"></script> Where the API returns something like [{'user':{'name':'Joe Bloggs'}}] (Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?
  - primaryobjects 13y ago
    It works on an explicit set, but not on initialization of the object. So: var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response. x.user = "wow"; This will trigger, however.
    - gsnedders 13y ago
      And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.
gsnedders 13y ago
No current browser should be vulnerable to this (ES5 requires object literals use [[DefineOwnProperty]], not [[Put]], and hence no setter on the prototype chain should be called). I believe all browsers have since fixed this.

If the attacker knows the structure of the reply, `__defineSetter__` can be used to extract the JSON content as well. From [0]: <script type="text/java

by pygy_ 13y ago

Jare 13y ago

ES4 requires using the original, unmodified bindings. From a comment: http://stackoverflow.com/questions/16289894/is-json-hijacking-still-an-issue-in-modern-browsers/16880162#16880162 http://stackoverflow.com/questions/16289894/is-json-hijackin...

primaryobjects 13y ago

That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome. Example http://jsfiddle.net/V53BL http://jsfiddle.net/V53BL

madeofpalk 13y ago
I can't get this to work with an actual API call. <script> Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)}); var trigger = [{"user":{}}]; </script> <script id='current-user' src="http://my.secretapi.com/users/current"></script> Where the API returns something like [{'user':{'name':'Joe Bloggs'}}] (Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?
- primaryobjects 13y ago
  It works on an explicit set, but not on initialization of the object. So: var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response. x.user = "wow"; This will trigger, however.
  - gsnedders 13y ago
    And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.

gsnedders 13y ago

No current browser should be vulnerable to this (ES5 requires object literals use [[DefineOwnProperty]], not [[Put]], and hence no setter on the prototype chain should be called). I believe all browsers have since fixed this.