JSON Hijacking as the name suggests is an attack similar to Cross-Site Request Forgery where an attacker can access cross-domain sensitive JSON data from applications that return sensitive data as array literals to GET requests. An example of a JSON call returning an array literal is shown below:
This attack can be achieved in 3 major steps:
- Step 1: Get an authenticated user to visit a malicious page.
- Step 2: The malicious page will
try and access sensitive data from the application that the user is logged into.
This can be done by embedding a script tag in an HTML page since the
same-origin policy does not apply to script tags.
<script src="http://<json site>/json_server.php"></script>
- The browser will make a GET request to json_server.php and any authentication cookies of the user will be sent along with the request.
- Step 3: At this point while the malicious site has executed the script it does not have access to any sensitive data. Getting access to the data can be achieved by using an object prototype setter. In the code below an object prototypes property is being bound to the defined function when an attempt is being made to set the “ccnum” property.
secrets = secrets.concat(" ", obj);
- At this point the malicious site has successfully hijacked the sensitive financial data (ccnum) returned by json_server.php
There are several ways in which JSON Hijacking can be prevented:
- Since SCRIPT tags can only generate HTTP GET requests, only return JSON objects to POST requests.
- Implement Cross-Site Request Forgery protection by requiring that a predefined random value be required for all JSON requests.