2

I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. They would be using Angular.

I was going through Angular's security guide which says,

Cross-site script inclusion, also known as JSON vulnerability, can allow an attacker's website to read data from a JSON API. The attack works on older browsers by overriding built-in JavaScript object constructors, and then including an API URL using a tag.

This attack is only successful if the returned JSON is executable as JavaScript. Servers can prevent an attack by prefixing all JSON responses to make them non-executable, by convention, using the well-known string ")]}',\n".

I checked the related questions on SO/SE. Going by the accepted answers, it seems that this used be a vulnerability a long time ago when browsers allowed overriding Array constructor. Is it still possible to have JSON vulnerability attack given latest version of Chrome will be used?

Related SE/SO questions:

  1. Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?
  2. How is it possible to poison JavaScript Array constructor and how does ECMAScript 5 prevent that?
  3. How does including a magic prefix to a JSON response work to prevent XSSI attacks?
  4. https://stackoverflow.com/questions/55206306/is-facebook-suddenly-safe-against-json-hijacking/55206724#55206724
  5. https://stackoverflow.com/questions/3146798/why-do-people-put-code-like-throw-1-dont-be-evil-and-for-in-front-of#3147804
6
  • Suppose, I have a REST API like 651ec54444a3a8aa4768fa35.mockapi.io/endpoints. Can you give an example of how it JSON vulnerability/hijackng can be done for this?
    – user120947
    Commented Oct 5, 2023 at 17:36
  • If you are revealing any information that should be secret AND using CORS headers that allow any origin, I think you MIGHT be vulnerable to this even if your response is standard JSON, (not just JSONP with Javascript methods) I found that with CORS off you would have a syntax error returned if it's a standard JSON array, but the JSON itself is available in the response (at least I can see it in dev tools)... I couldn't figure out if onerror event would/could reveal that data though. With standard CORS, the response doesn't come back. (unclear if that's due to authorization failing) Commented Oct 5, 2023 at 18:26
  • You may also want to check if you log anything to console, as I believe you could read that client-side, but not necessarily the response body. ( I didn't check your specific site... this is all general info and I'm really not sure. Your post made me curious though and no one else was responding) Commented Oct 5, 2023 at 18:31
  • Thanks @pcalkins. I can't control the client-side JS code, but only the REST APIs. I do know that it would be run on enterprise network with no access to public internet. Also, only the latest versions of Chrome browser would be installed as mandated by corporate policy. Given such conditions, I am curious to know if it is worth the overhead of prefix all my JSON responses with ")]}',\n".
    – user120947
    Commented Oct 5, 2023 at 18:56
  • 1
    It's basically CSRF with a GET. If authorization is handled via headers, I don't think you'd be vulnerable. If it's a cookie and it's set strict if cross-site, you should also be OK. All requests that respond with sensitive information should require authorization. In my case authorization is handled via cert, session is maintained via cookie strict same-site, but it seems like if I had loosened CORS restrictions using CORS headers, AND I returned sensitive info via GET there might be a problem there. My CSRF protections don't happen with GETs. Commented Oct 5, 2023 at 19:28

1 Answer 1

3

JSON Hijacking is pretty much dead - it's been patched in all major browsers for years. My colleague did some research into this in 2016 but all the bugs mentioned are now patched: https://portswigger.net/research/json-hijacking-for-the-modern-web

Note that JSON hijacking shouldn't be confused with use of JSONP, which can definitely still leak data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .