There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { return ' + this + '}' )).call({}); };
var s = 'alert("hello!");'
s.code();
What infrastructure components need to be updated (if any) to monitor and protect from this class of exploit?
For example:
I'm under the impression that some DBA's scan their databases for evidence of a injection attack... this is almost a last-stand approach for mitigating a poorly written application in a distributed enterprise.
When I last worked with Microsoft on a JS Injection attack, the developer in India didn't properly verify form input. This caused our client's database to be littered with Javascript code that executed on the client. Microsoft's response was to search the database for pre-defined strings that are commonly used in attacks.
I'm assuming that there are products or sensors that monitor SQL or HTTP traffic for obvious js-malware. If I take my assumption a step further, those devices need to have the signature updated for this vector.