Ajax security surprises: web-aggregators, offline applications and frameworks

Brian Dillard, Tuesday, January 29, 2008 @ 12:50 pm

I'm still absorbing the densely packed information from "Ajax Security," the first-rate book by Billy Hoffman and Bryan Sullivan that I recently recommended in these pages. Here, in no particular order, are three of the most surprising lessons imparted by Messrs. Sullivan and Hoffman:

Web aggregators and SSL

This is probably a great big "duh" to some developers, but web aggregators such as iGoogle and NetVibes often compromise the security of otherwise SSL-encrypted web applications when funneling content from them to your personalized homepage:

Now, consider what happens when you use a Gmail widget on an aggregate site like NetVibes. Sharp-eyed readers will notice the URL for NetVibes ... is http://www.netvibes.com. This is not an encrypted connection! NetVibes sends user data in the clear from the aggregate to the user.... NetVibes makes an SSL connection to Gmail, and then NetVibes degrades the level of security by transmitting the data over an unencrypted connection. Our attacker ... can steal the data much more easily now. NetVibes is not providing the same level of security that a user would receive if he accessed Gmail directly. This situation is not unique to NetVibes and Gmail.... At the time of publication, every major aggregate Web site the authors examined downgraded security on data from secure sources. [emphasis theirs]

Offline applications and client-side validation

Security experts, including Hoffman and Sullivan, have long trumpeted the danger of relying on client-side input validation without parallel server-side validation. But with offline applications, they argue, client-side validation becomes absolutely necessary:

[O]ffline Ajax frameworks increase the client's role in business logic. In fact, offline Ajax applications strive to make the concept of online or offline completely transparent to the user.... [T]his means the user is interacting with client-side code, which stores everything the user is doing and synchronizes the data with the Web server when the client connects to the Internet. If no client-side input validation occurs, then the client-side logic is vulnerable to all kinds of parameter manipulation attacks.... Ajax applications already push more of a Web application to the client, and offline Ajax applications do push even more logic to the client. Just as we perform whitelist input validation on the server for security purposes, developers must perform client-side validation to ensure the security of their offline Ajax applications.

Ajax frameworks and function clobbering

When an attacker gains access to a web server and appends JavaScript code to a running Ajax application, it's much easier to inflict damage on apps that employ well-known JavaScript frameworks:

[T]his works with any framework and almost any JavaScript function.... Consider Dojo.Storage, which provides an abstraction layer to the various mechanisms for client-side storage.... Ironically, most of the functions to access client-side storage methods cannot be hooked because of how they are implemented. We cannot, for example, clobber the ActionScript functions exposed by a Flash object from browsers that we can clobber. Thus we cannot hook read and writes on the document.cookie object (at least we can't for all browsers). However, by hijacking the abstraction function in Dojo.Storage, attackers can intercept all data as it moves in and out of client-side storage, regardless of where the data is actually stored on the client. Essentially, certain browser functionality cannot be shimmed directly for all browsers, but frameworks that abstract this functionality can, themselves, be shimmed, accomplishing the same thing. Even worse ... shim code that hijacks frameworks isn't Web site or domain specific. The same playload can be used against multiple Web sites.

The book itself, of course, documents dozens more specific security vulnerabilities - as well as best practices for protecting your application against them. I said it before, and I'll say it again: "Ajax Security" is required reading for any professional software engineer.

(On a totally unrelated note, I loved the authors' repeated shoutouts in their example code to Brad Neuberg, author of Dojo.Offline and creator of Really Simple History.)

agile ajax

Comments: 2 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   I haven’t seen the book yet; are they positive or negative shoutouts?

   Brad

   Comment by Brad Neuberg, Thursday, January 31, 2008 @ 5:54 pm

2. 

   @Brad: Kind of … Neutral. Your name pops up in example code, and so, I think, does the Coding in Paradise URL. It’s more in-jokey than anything. They talk a lot about Dojo Storage and Dojo Offline, so obviously they know your work.

   Comment by Brian Dillard, Tuesday, February 5, 2008 @ 4:42 pm

Leave a comment