Imperva identifies AJAX flaw

Attackers could exploit the AJAX flaw to break into back-end systems or launch a DoS attach, Imperva says

Security vendor Imperva has identified a vulnerability in AJAX, which it says an attacker could use to compromise an application based on the Web scripting components known collectively as AJAX (Asynchronous JavaScript + XML).

The vulnerability in the Direct Web Reporting component of the AJAX development framework is probably the first server-side-based vulnerability to be identified, according to Imperva, which has issued guidance on a workaround that would let application programmers close the hole.

“It’s an access-control vulnerability,” says Amichai Shulman, CTO at Imperva. The flaw, as described online by Imperva’s Application Defense Center group, would let an attacker break into back-end databases and servers or launch a denial-of-service-attack. Imperva noted that the AJAX Web application development framework is “emerging as the lingua franca for building new generation Web 2.0 applications” such as Google Maps.

“We will see more and more of these vulnerabilities in the server-side framework,” Shulman predicts. He says for now, it’s the responsibility of application programmers to correct the flaw identified by Imperva, which may impact their applications.

Learn more about this topic

Imperva’s advisory on the DWR vulnerability

01/03/07

AJAX accelerates Web applications

01/16/06

AJAX presents corporate problems, opportunities

05/22/06

   
Insider Shootout: Best security tools for small business
Join the discussion
Be the first to comment on this article. Our Commenting Policies