How to exploit escapable JSON parameters

Question

I have an HTML page with this bit of code in it:

<div>
<div id="login-container"
     class="login-container">
    <login-page params="{&quot;redacted&quot;:&quot;redacted&quot;}"></login-page>

</div>

So where it says redacted, there are a lot of parameters, and one of them is modifiable using a URL parameter, meaning I can change this parameter in the URL to abc and it will put abc into those JSON brackets. Using this, I found that it does not properly filter braces, meaning that in this parameter I can put braces that are parsed as a new JSON area within the braces already there.

It's hard to explain but for example, I can make the URL parameter "{test}", and those above parameters will look like the following (assuming one of the redacted areas was the URL parameter's output:

{"redacted":"{test}"}

It seems that being able to put my own JSON brackets in here should allow me to run my own JSON code, but is this possible, and is there any risk associated with the fact that they don't filter braces at all?

Thanks

Answer 1

I am going to ignore everything cept:

and is there any risk associated with the fact that they don't filter braces at all

In a word No.

What you are looking at is all Client Side HTML/JS and while I could see how you would believe modifying it would be a security flaw ... It isnt really, because it only effects you and your computer.

For example if you press F12 in your browser and type the following into the console:

y = document.getElementsByClassName('gravatar-wrapper-32');
for (idx = 0, len = y.length; idx < len; ++idx) {
  y[idx].firstChild.src = "https://www.gravatar.com/avatar/370bb2bee74fc88763dc0fe35477e24c?s=32&d=identicon&r=PG"
}

All of the gravatar images on the page will be changed to mine ... and this is how you hack the gibson ... just kidding

But if you bring up the same page in another tab you will notice that this change has only effected the first tab ... thus it will not effect anyone else on the site.

The same is true for your login-page params ... if you wanted to you could just change the entire string on client side and ... no one would really care. when you submit the JSON is the real test.

If the developer of the Server Side code does not properly validate the JSON to make sure extra things where not added or removed THEN there would be risks associated (but that is a topic for another question).