I have a webpage that is running some javascript that:

  1. Reads in a URL from a URL query param
  2. Without validating the URL, makes a request to it
  3. Validates the response - ensures that the response is a 200 and parses the JSON in a safe way, extracting the data it expects
  4. Uses the parsed data for some additional requests. Of course these additional requests fail unless the attacker-controlled server somehow serves valid information, which it should never have access to.

This seems like a vulnerable flow to me, though I haven't found a way to convincingly exploit the lack of URL validation. The specific attack scenario I was playing out is an attacker that set the arbitrary URL to point to a server they control, and sends that link to a legitimate user. Their server would have open CORS permissions and send back whatever data the attacker specifies.

The protections I have:

  • The request is made via Javascript on the webpage, so SSRF doesn't apply here.

  • The HTTP response from the specified server has to return a 200, otherwise the Javascript throws an error.

  • The JSON response is parsed and validated - Attackers can send whatever values they want, but I don't think they can send anything that breaks the Javascript and allows for XSS, for instance.

  • The request is a normal Ajax XMLHTTPRequest, which seems to prevent any control over the user's browser window such as open redirects or simply prompting the user to download malware.

If I'm performing proper validation on the JSON, is there a reason I need to validate the URL I'm pulling it from? Does allowing an attacker to specify an arbitrary GET request on a user's behalf through a benign-looking link constitute a security risk?

  • “Uses the parsed data for some additional requests” seems relevant. What’s the “valid information” that the attacker can’t provide? Is there some kind of MAC involved?
    – Ry-
    Feb 20, 2019 at 18:11
  • 1
    parses the JSON in a safe way is the critical part of it. Can you really assure the parser is safe?
    – ThoriumBR
    Feb 20, 2019 at 18:59
  • @Ry- The data the javascript expects is a user ID and csrf token. What do you mean by MAC?
    – Buffalo5ix
    Feb 20, 2019 at 19:03
  • @ThoriumBR the JSON is parsed with Javascript's JSON.parse() method, which by all accounts I've seen is safe to deserialization and other common parsing vulnerabilities.
    – Buffalo5ix
    Feb 20, 2019 at 19:03
  • @Ry- The auth is done with cookies, so no auth information will be sent to an attacker's server via the xhr request.
    – Buffalo5ix
    Feb 20, 2019 at 19:09


You must log in to answer this question.

Browse other questions tagged .