Hacker News Reader

Comment by pygy_ | Hacker News Reader

If the attacker knows the structure of the reply, `__defineSetter__` can be used to extract the JSON content as well. From [0]:

        <script type="text/javascript"> 
            Object.prototype.__defineSetter__('Id', function(obj){alert(obj);});
        </script> 
        <script src="http://example.com/Home/AdminBalances">/*Boom*/</script>

[0]: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/

View on HN

ES4 requires using the original, unmodified bindings. From a comment: http://stackoverflow.com/questions/16289894/is-json-hijackin...

That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome.

Example http://jsfiddle.net/V53BL

I can't get this to work with an actual API call.

    <script>
          Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)});
          var trigger = [{"user":{}}];
     </script>
     <script id='current-user' src="http://my.secretapi.com/users/current"></script>

Where the API returns something like

    [{'user':{'name':'Joe Bloggs'}}]

(Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?

It works on an explicit set, but not on initialization of the object. So:

var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response.

x.user = "wow"; This will trigger, however.

And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.

No current browser should be vulnerable to this (ES5 requires object literals use [[DefineOwnProperty]], not [[Put]], and hence no setter on the prototype chain should be called). I believe all browsers have since fixed this.

Reply on news.ycombinator.com