AJAX Apps Ripe Targets for JavaScript Hijacking

By Lisa Vaas Print this article Print

A pervasive vulnerability that allows an attacker to take over any Web browser and silently intercept sensitive data input occurs in Web 2.0 settings from Yahoo to ASP .Net to Google, security firm Fortify says.

Fortify Software has documented what the security firm is calling a "pervasive and critical" vulnerability in Web 2.0 applications—specifically, in the ability of an attacker to use a JavaScript vulnerability to steal critical data by emulating unsuspecting users.

The vulnerability—which allows an exploit called JavaScript Hijacking—can be found in the biggest AJAX frameworks out there, including three server-integrated toolkits: Microsoft ASP.Net AJAX (aka Atlas), Google Web Toolkit and xajax—the last of which is an open-source PHP-class library implementation of AJAX.

Client-side libraries that Fortify inspected and found to be vulnerable are the Yahoo UI, Prototype, Script.aculo.us, Dojo, Moo.fx, jQuery, Rico and MochiKit.

Of the AJAX frameworks and client-side libraries Fortify inspected, only DWR 2.0 (Direct Web Remoting 2.0) has mechanisms to prevent JavaScript Hijacking.

That isn't surprising, given that Joe Walker, who developed DWR, wrote about the JavaScript Hijacking flaw in early March.

According to Fortify, the other AJAX frameworks don't explicitly provide any protection, nor do their documentation materials mention the vulnerability as a security concern.

Brian Chess, Fortify Software's co-founder and Chief Scientist, told eWEEK that the security firm is getting a ho-hum reaction from some regarding the news, since JavaScript has never been considered to be safe anyway.

"Everybody hears, 'Oh, there's a JavaScript security problem,' and everybody says, 'Oh yeah, everybody knows JavaScript is a security concern in itself,'" Chess said.

This, however, is the first type of JavaScript problem that Chess knows of that specifically targets AJAX-style and Web 2.0-style applications, he said.

Click here to read more about JavaScript security concerns.

What's happening, Chess said, is that AJAX-style applications are dropping the X off of AJAX, which stands for Asynchronous JavaScript and XML. Thus, the applications are doing all their work in JavaScript, particularly using it as their data transport format.

The gotcha is that Web browsers don't protect JavaScript as they do HTML or other protocols they transport. This allows rogue hackers to get hold of sensitive data that most developers think they've protected, Chess said.

"The attacker can put code in a Web page," he said. "If he can trick you into running it in your browser, your browser can look like you and act like you, but it's not you; it's actually shoveling data back to [the attacker]."

The problem specifically lies in JSON (JavaScript Object Notation), a lightweight data interchange format that for some time has been known to have security problems.

The text-based, human-readable format for representing objects and other data structures is mostly used to transmit structured data over a network connection.

Yahoo began offering some of its Web Services optionally in JSON in December 2005, and Google started offering JSON feeds for its GData Web protocol in December 2006.

Next Page: Finding a way in.

This article was originally published on 2007-04-02
Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.
eWeek eWeek

Have the latest technology news and resources emailed to you everyday.