AJAX: Savior or Security Scourge?
"Computers have enabled people to make more mistakes faster than almost
any invention in history, with the possible exception of tequila and hand
guns." --Mitch Ratcliffe
After a recent announcement by threat identification and remediation tools
vendor Fortify Software, maybe we should add AJAX to that list. The company
says a security vulnerability could make AJAX-based applications susceptible
to "JavaScipt hijacking," which lets unauthorized parties read private
content within JavaScript messages. You can read all about it in Jeffrey Schwartz's
article here.
Of course, JavaScript exploits are nothing new. In January, Adobe
kicked off a bit of JavaScript madness with its thoughtless implementation
of JavaScript in the ubiquitous Acrobat browser plug-in. The setup pretty much
opened the floodgates to phishers -- all they needed to do was get someone to
click on a valid PDF file link.
But Brian Chess, co-founder and chief scientist at Fortify, says this is not
your father's browser-based security problem. "It's not a new name for
an old kind of problem. This is a new JavaScript-related problem that arises
in AJAX-style applications," Chess said.
At issue are the AJAX frameworks and client-side libraries used for AJAX development,
which Fortify found are often not designed to prevent JavaScript hijacking.
The Microsoft ASP.NET AJAX tool (code-named Atlas), Google Web Toolkit and libraries
such as Prototype, DoJo and Yahoo! UI are all affected, says Fortify.
The good news? Patching the hole should be quick work for tool providers, and
developers can certainly prevent private information from being transmitted
without authentication. Of course, all this argues back to the biggest issue
with JavaScript and, going forward, AJAX. That is: In an era of intensely connected
applications, you cannot afford to write crappy code.
What do you think? If we set down the hand guns and tequila bottles and focus
on writing good code, can we ever hope to avoid calamitous mistakes? How is
your company making sure its AJAX code isn't vulnerable? E-mail me at mdesmond@reddevnews.com.
Posted by Michael Desmond on 04/04/2007