Exploiting JavaScript’s eval() method

by

As B-Con mentioned, the attacker is not the one sitting at the computer so could be using the eval() already in your script as a means to pass malicious code to your site in order to exploit the current user’s session in someway (e.g. a user following a malicious link).

The danger of eval() is when it is executed on unsanitised values, and can lead to a DOM Based XSS vulnerability.

e.g. consider the following code in your HTML (rather contrived, but it demonstrates the issue I hope)

<script>

eval('alert("Your query string was ' + unescape(document.location.search) + '");');

</script>

Now if the query string is ?foo you simply get an alert dialog stating the following: Your query string was ?foo

But what this code will allow a user to do is redirect users from their site to a URL such as http://www.example.com/page.htm?hello%22);alert(document.cookie+%22, where www.example.com is your website.

This modifies the code that is executed by eval() to 

alert("Your query string was hello");
alert(document.cookie+"");

(New lines added by me for clarity). Now this could be doing something more malicious than showing the current cookie value, as the required code is simply passed on the query string by the attacker’s link in encoded form. For example, it could be sending the cookie to the attacker’s domain in a resource request, enabling the authentication session to be hijacked.

This applies to any value from user/external input that is unsanitised and executed directly in the eval(), not just the query string as shown here.

More Related Contents:

  1. Why is using the JavaScript eval function a bad idea?
  2. Is Javascript eval() so dangerous? [duplicate]
  3. how to make sure only my own website (clientside code) can talk to Firebase backend?
  4. Alternatives to JavaScript eval() for parsing JSON
  5. How to secure javascript code from being run on other domain (stolen) ? need more ideas
  6. Convert a string to a template string
  7. Are eval() and new Function() the same thing?
  8. Why does JavaScript’s eval need parentheses to eval JSON data?
  9. Is it possible to check dimensions of image before uploading?
  10. Unsafe JavaScript attempt to access frame in Google Chrome
  11. Specify scope for eval() in JavaScript?
  12. IF Statement Always True
  13. Secure distribution of NodeJS applications
  14. What are the AES parameters used and steps performed internally by crypto-js while encrypting a message with a password?
  15. Safely sandbox and execute user submitted JavaScript?
  16. Pagination: Server Side or Client Side?
  17. Security Issues for allowing users to add own JavaScript to your site?
  18. How to prevent html/JavaScript code modification
  19. Accessing or creating nested JavaScript objects with string key without eval
  20. Hacked Site – SSH to remove a large body of javascript from 200+ files [closed]
  21. Save to Local File from Blob
  22. Image brightness detection in client side script
  23. How to code a calculator in JavaScript without ‘eval’
  24. Getting the text from a drop-down box
  25. Why does Google prepend while(1); to their JSON responses?
  26. Web application access user’s file system
  27. How to secure the JavaScript API Access Token?
  28. Reading line-by-line file in JavaScript on client side
  29. How can I create a file for storage on the client side with JavaScript?
  30. Javascript – key / certificate from USB Token

Leave a Comment