News for hackers. Stuff that matters.

A comment on Useful Old Technologies: ASN.1 (2013). Parent comment

Re:Useful Old Technologies: ASN.1 (2013) by throwaway894345 on Sunday December 26, 2021 @08:47AM (#29692311)
JSON is very widely used, so if it’s properties were bad for security, we should expect different JSON-based attacks popping up every week, right? How often do we see these kinds of attacks?
[ Parent | on HN ]
Re:Useful Old Technologies: ASN.1 (2013) by patrec on Sunday December 26, 2021 @12:48PM (#29694522)
It's not hard to find quite recent json parsing vulnerabilities, e.g.

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-b...

A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json

Here is a nice blog post walking through various JSON based exploits:

https://bishopfox.com/blog/json-interoperability-vulnerabili...

[ Parent | on HN ]
Re:Useful Old Technologies: ASN.1 (2013) by throwaway894345 on Sunday December 26, 2021 @02:42PM (#29695599)
Interesting. I haven’t talk heard of any of those.
[ Parent | on HN ]