AJAX Apps Ripe Targets for JavaScript Hijacking

Fortify Software has documented what the security firm is calling a “pervasive and critical” vulnerability in Web 2.0 applications—specifically, in the ability of an attacker to use a JavaScript vulnerability to steal critical data by emulating unsuspecting users.

The vulnerability—which allows an exploit called JavaScript Hijacking—can be found in the biggest AJAX frameworks out there, including three server-integrated toolkits: Microsoft ASP.Net AJAX (aka Atlas), Google Web Toolkit and xajax—the last of which is an open-source PHP-class library implementation of AJAX.

Client-side libraries that Fortify inspected and found to be vulnerable are the Yahoo UI, Prototype, Script.aculo.us, Dojo, Moo.fx, jQuery, Rico and MochiKit.

Of the AJAX frameworks and client-side libraries Fortify inspected, only DWR 2.0 (Direct Web Remoting 2.0) has mechanisms to prevent JavaScript Hijacking.

That isn’t surprising, given that Joe Walker, who developed DWR, wrote about the JavaScript Hijacking flaw in early March.

According to Fortify, the other AJAX frameworks don’t explicitly provide any protection, nor do their documentation materials mention the vulnerability as a security concern.

Brian Chess, Fortify Software’s co-founder and Chief Scientist, told eWEEK that the security firm is getting a ho-hum reaction from some regarding the news, since JavaScript has never been considered to be safe anyway.

“Everybody hears, ‘Oh, there’s a JavaScript security problem,’ and everybody says, ‘Oh yeah, everybody knows JavaScript is a security concern in itself,'” Chess said.

This, however, is the first type of JavaScript problem that Chess knows of that specifically targets AJAX-style and Web 2.0-style applications, he said.

Click here to read more about JavaScript security concerns.

What’s happening, Chess said, is that AJAX-style applications are dropping the X off of AJAX, which stands for Asynchronous JavaScript and XML. Thus, the applications are doing all their work in JavaScript, particularly using it as their data transport format.

The gotcha is that Web browsers don’t protect JavaScript as they do HTML or other protocols they transport. This allows rogue hackers to get hold of sensitive data that most developers think they’ve protected, Chess said.

“The attacker can put code in a Web page,” he said. “If he can trick you into running it in your browser, your browser can look like you and act like you, but it’s not you; it’s actually shoveling data back to [the attacker].”

The problem specifically lies in JSON (JavaScript Object Notation), a lightweight data interchange format that for some time has been known to have security problems.

The text-based, human-readable format for representing objects and other data structures is mostly used to transmit structured data over a network connection.

Yahoo began offering some of its Web Services optionally in JSON in December 2005, and Google started offering JSON feeds for its GData Web protocol in December 2006.

Next Page: Finding a way in.