TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Abusing JSONP with Rosetta Flash

77 点作者 moonlander将近 11 年前

6 条评论

Sephr将近 11 年前
The mitigation strategy falls short of current best practices.<p>&gt; if possible use a dedicated sandbox domain.<p>It&#x27;s 2014. You don&#x27;t have to use JSONP and open up your domain to XSS; just use standard and safe XHR with CORS[1]. Every major browser has supported it for years, and for very old browsers that don&#x27;t support CORS (IE 8), I wrote pmxdr[2] five years ago.<p>[1]: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Access_con...</a><p>[2]: <a href="https://github.com/eligrey/pmxdr" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;eligrey&#x2F;pmxdr</a>
评论 #8006528 未加载
评论 #8005304 未加载
simonw将近 11 年前
This is a really, really nasty attack. If you allow JSONP on your domain you are almost certainly vulnerable.
btown将近 11 年前
Given the nastiness of this attack (a fully interactive client-side backdoor!), the non-trivial nature of the algorithms and coding theory required, and the slow uptake of Flash patches especially in enterprise [1], this seems like downright irresponsible disclosure to share such a detailed post (with a repository and detailed instructions for script kiddies!) so quickly after notifying companies. I can understand all too well how excited the researcher must have been to discover this and share it with the world, but jeez: wait until the Flash patch hits an inflection point on the adoption curve at least!<p>[1](<a href="http://krebsonsecurity.com/2014/05/the-mad-mad-dash-to-update-flash/#more-25957" rel="nofollow">http:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2014&#x2F;05&#x2F;the-mad-mad-dash-to-updat...</a>)
amenghra将近 11 年前
Nice to see the exploit finally out.<p>I gave a talk about the potential for this to happen about a year ago: <a href="http://quaxio.com/jsonp_handcrafted_flash_files/" rel="nofollow">http:&#x2F;&#x2F;quaxio.com&#x2F;jsonp_handcrafted_flash_files&#x2F;</a>
评论 #8007632 未加载
simonw将近 11 年前
The article suggests a 32 character length limit on callback parameters. Unfortunately this looks to be too short - from examining log files it appears jQuery often uses callbacks of 40 or even 44 characters.
spacemanmatt将近 11 年前
Why is JSONP any less than an XSS exploit waiting to happen?
评论 #8004744 未加载
评论 #8008174 未加载