2

In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes:

The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the calling script.The developers never realized that attackers could send users directly to the JSON output. While AJAX and JSON do not generally introduce new holes per se, they definitely can increase the attacker’s surface area.

I thing there is no way for the attacker to force victim's browser to run javascript from JSON directly. Is there any example that shows the authors intended purpose?

Improve this question
1

1 Answer 1

Reset to default
1

By surface area, Grossman is referring to the principle that the probability of successful attack increases as more of a system's security boundary is identified. 1

In the question, the surface penetration for the an attacker to run JavaScript from JSON (whichhttp://blog.watchfire.com/wfblog/2011/10/json-based-xss-exploitation.html may arrive at the browser through an asynchronous RESTful GET or POST) may require two breach points.

  • The ability to inject JavaScript into the RESTful JSON stream
  • The ability to transfer execution to one of the objects instantiated during parsing

Depending on the conditions prior to the attack 2, one or both of those mechanisms may already be in place, therefore not requiring that particular breach. 3

The direct answer to the question is that the various documented XSS attacks can be used to accomplish either or both of those breaches. Which ones that might be used will depend on the details of the surface Grossman mentions.

There is an example in the comment from @rápli-andrás, and here is a good overview with more code examples.

[1] Once a breach occurs, if there is no further security surface, the attack is complete. Otherwise it is partial, which still may facilitate the attacker's objectives.

[2] Conditions include the design of the system and its current execution state in the browser and server.

[3] This may have contributed to the vulnerability with the Google Reader.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .