I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side

One of the security recommendation is - Always return JSON with an Object on the outside

And showing an example that this can be exploitable -

[{"object": "inside an array"}]

But this can not

{"object": "not inside an array"}

Now can anyone give me an practical example why the above one is exploitable and in what condition? And why the below one can not be exploitable?

  • The JSON is not vulnerable. Rather, the concern is that a CORS request could secretly request that API endpoint and exfiltrate the data by loading the JSON as a JavaScript source code and overloading the Array constructor, see <haacked.com/archive/2008/11/20/…> (note that this is from 2008, browsers have changed since then). Due to JavaScript statement syntax, this doesn't work for objects. But there are so many things that have to go wrong first that I don't think it's worth thinking about “JSON vulnerabilities” in 2022.
    – amon
    Jun 20 at 10:31
  • note that this is from 2008, so many things that have to go wrong first [not] worth thinking about ... in 2022: OWASP in a nutshell! I'm being snarky, but I mostly endorse saying it anyhow. People treat OWASP as gospel, but frankly by volume it's mostly outdated, often nonsense, and full of bad recommendations even for real problems. The latest Top 10 list is the only one I have ever had the least respect for, and the stuff off the Top 10 is incredibly poor quality. If something on OWASP doesn't make sense, ask about it, but don't blindly assume that OWASP knows what it's talking about.
    – CBHacking
    Jun 21 at 3:32


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.