In addition to XSS, injection attacks on Web 2.0 still target SQL and Lightweight
Directory Access Protocol (LDAP), but now include XPATH/XQUERY, XML, JSON, and
JavaScript arrays. Cross-site request forgery (CSRF) attacks are still present in Web 2.0,
but they can now be worse with bidirectional CSRF (JavaScript hijacking). Further, the
inconsistent security limits set on XMLHttpRequest (XHR) can leave Web 2.0 applications
that are vulnerable to CSRF exposed to worm type behavior, automatic prorogation
of a security flaw, rather that a simple one-click attack that would appear on a Web 1.0
application. For example, since many Web 2.0 applications contain integrated interaction
between users, when an application flaw such as XSS appears in the application, the
propagation of the flaw from one user to the other is even more possible. The prorogating
functionality was shown clearly with the Samy worm on MySpace.com, which is
discussed in Chapter 5 and the first case study.
Another security impact in addition to worm propagation is the idea of cross-domain
attacks. Cross-domain attacks allow attackers to publish malicious content to web users
without users??™ knowledge or permission.
Pages:
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49