News for hackers. Stuff that matters.

A comment on Abusing JSONP with Rosetta Flash. Parent comment

Re:Abusing JSONP with Rosetta Flash by simonw on Tuesday July 08, 2014 @10:47AM (#8004744)
I don't think you can use JSONP for XSS. The JavaScript does to execute on the domain that hosts the JS, it executes in the context of the page that loaded the code using a script tag. Allowing attacker-controlled script tags is definitely an XSS hole.
[ Parent | on HN ]
Re:Abusing JSONP with Rosetta Flash by eli on Tuesday July 08, 2014 @11:47AM (#8005081)
The linked article demonstrates even just allowing attacker-controlled function name can allow an XSS hole!
[ Parent | on HN ]
Re:Abusing JSONP with Rosetta Flash by simonw on Tuesday July 08, 2014 @12:27PM (#8005314)
That's due to an extremely complex (albeit easy to exploit) SWF reflection attack.

JSONP itself, though yucky, should still be safe from XSS given a /-star-star-/ prefix and a validated callback parameter.

[ Parent | on HN ]
Re:Abusing JSONP with Rosetta Flash by spacemanmatt on Tuesday July 08, 2014 @12:45PM (#8005402)
> given a /-star-star-/ prefix and a validated callback parameter.

I think that is the "waiting to happen" part of my initial comment.

[ Parent | on HN ]