JavaScript hijacking - a new exploit, or not? • The Register

JavaScript hijacking - a new exploit, or not?

Have you heard it all before?

By David Norfolk • Get more from this author

Posted in Developer, 3rd April 2007 15:24 GMT

Understand how application security is evolving

I've had an email comment on my JavaScript Hijacking piece to the effect that everyone knows that you do your input validation on the server and that data you send down in JavaScript or in HTML is unsafe - so this really isn't a new exploit.

Well, that first part is true enough, but I disagree with the second. However, Brian Chess is about to put up a JavaScript Hijacking FAQ in the Fortify Software site, so I thought (in the best journalistic tradition) I'd nick his comment on this point.

"While it is true that the client can see any messages the server sends, this is not the scenario where JavaScript Hijacking applies. JavaScript Hijacking involves a vulnerable website, a victim with a web browser, and a malicious website. The malicious website can use JavaScript hijacking to steal the victim's data from the vulnerable website. Web browsers prevent this in most cases, but the browser makers did not anticipate the use of JavaScript to communicate confidential data," he says.

I'll also note that Fortify's advisory, referenced in the original article, explains this new exploit in great detail and, I think, makes clear what is new about it. ®

Tune into our application security webcast, click here