JavaScript hijacking - a new exploit, or not?
PrintHave you heard it all before?
Posted in Developer, 3rd April 2007 15:24 GMT
Free whitepaper – The top 5 server monitoring battles
I've had an email comment on my JavaScript Hijacking piece to the effect that everyone knows that you do your input validation on the server and that data you send down in JavaScript or in HTML is unsafe - so this really isn't a new exploit.
Well, that first part is true enough, but I disagree with the second. However, Brian Chess is about to put up a JavaScript Hijacking FAQ in the Fortify Software site, so I thought (in the best journalistic tradition) I'd nick his comment on this point.
"While it is true that the client can see any messages the server sends, this is not the scenario where JavaScript Hijacking applies. JavaScript Hijacking involves a vulnerable website, a victim with a web browser, and a malicious website. The malicious website can use JavaScript hijacking to steal the victim's data from the vulnerable website. Web browsers prevent this in most cases, but the browser makers did not anticipate the use of JavaScript to communicate confidential data," he says.
I'll also note that Fortify's advisory, referenced in the original article, explains this new exploit in great detail and, I think, makes clear what is new about it. ®
The Register Agile Data Center Summit
Market Primer: ERP Systems
Analyst Keynote: The Register Agile Data Center Summit
Buyer's Guide: ERP Systems
Checklist: Midmarket ERP Solutions
Office 2010 fights Google with SharePoint bloat
Ubuntu's Karmic Koala bares fangs at Windows 7
Icon design for 
Microsoft 'Dallas' muscles Google data crusade