Desmond File

Blog archive

AJAX: Savior or Security Scourge?

"Computers have enabled people to make more mistakes faster than almost any invention in history, with the possible exception of tequila and hand guns." --Mitch Ratcliffe

After a recent announcement by threat identification and remediation tools vendor Fortify Software, maybe we should add AJAX to that list. The company says a security vulnerability could make AJAX-based applications susceptible to "JavaScipt hijacking," which lets unauthorized parties read private content within JavaScript messages. You can read all about it in Jeffrey Schwartz's article here.

Of course, JavaScript exploits are nothing new. In January, Adobe kicked off a bit of JavaScript madness with its thoughtless implementation of JavaScript in the ubiquitous Acrobat browser plug-in. The setup pretty much opened the floodgates to phishers -- all they needed to do was get someone to click on a valid PDF file link.

But Brian Chess, co-founder and chief scientist at Fortify, says this is not your father's browser-based security problem. "It's not a new name for an old kind of problem. This is a new JavaScript-related problem that arises in AJAX-style applications," Chess said.

At issue are the AJAX frameworks and client-side libraries used for AJAX development, which Fortify found are often not designed to prevent JavaScript hijacking. The Microsoft ASP.NET AJAX tool (code-named Atlas), Google Web Toolkit and libraries such as Prototype, DoJo and Yahoo! UI are all affected, says Fortify.

The good news? Patching the hole should be quick work for tool providers, and developers can certainly prevent private information from being transmitted without authentication. Of course, all this argues back to the biggest issue with JavaScript and, going forward, AJAX. That is: In an era of intensely connected applications, you cannot afford to write crappy code.

What do you think? If we set down the hand guns and tequila bottles and focus on writing good code, can we ever hope to avoid calamitous mistakes? How is your company making sure its AJAX code isn't vulnerable? E-mail me at [email protected].

Posted by Michael Desmond on 04/04/2007

comments powered by Disqus


Subscribe on YouTube