I recently learned about a very subtle potential security flaw when using JSON. While subtle, it was successfully demonstrated against GMail a while back. The post, JSON is not as safe as people think it is , covers it well, but I thought I?d provide step-by-step coverage to help make it clear how the exploit works. The exploit combines Cross Site Request Forgery (CSRF) with a JSON Array hack allowing an evil site to grab sensitive user data from an unsuspecting user. The hack involves redefining the Array constructor, which is totally legal in Javascript. Let?s walk through the attack step by step. Imagine that you?re logged in to a trusted site. The site makes use of JavaScript which makes GET requests to a JSON service : GET: /demos/secret...(read more) ...
Go to the complete details ...