Tag Archives: security
Interesting JSON vulnerability (old stuff)
Somebody at work passed this article about an interesting vulnerability in web APIs that use JSON. The exploit combines Cross Site Request Forgery (CSRF) with a JSON Array hack allowing an evil site to grab sensitive user data from an unsuspecting user. The hack involves redefining the Array constructor, which is totally legal in Javascript. http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx [...]
