JSONP Callback Injection
Overview
JSONP (JSON with Padding) endpoints that reflect a user-supplied callback name without validation allow attackers to inject arbitrary JavaScript. JSONP is a legacy cross-origin technique that modern applications should replace with CORS.
Attack: https://api.example.com/data?callback=alert(document.cookie)//
Response: alert(document.cookie)//({"user": "admin"}) — executes JS
Remediation
- Replace JSONP with CORS
- If JSONP must be maintained, validate callback against
[a-zA-Z0-9._]+ - Set
Content-Type: application/javascriptnottext/html