JSONP Injection

Detects JSONP endpoints that reflect user-controlled callback names without validation, enabling XSS.

zakirkun 72755d7 2 files · 2.2 KB Updated

File contents

JSONP Callback Injection

Overview

JSONP (JSON with Padding) endpoints that reflect a user-supplied callback name without validation allow attackers to inject arbitrary JavaScript. JSONP is a legacy cross-origin technique that modern applications should replace with CORS.

Attack: https://api.example.com/data?callback=alert(document.cookie)// Response: alert(document.cookie)//({"user": "admin"}) — executes JS

Remediation

  • Replace JSONP with CORS
  • If JSONP must be maintained, validate callback against [a-zA-Z0-9._]+
  • Set Content-Type: application/javascript not text/html

zakirkun/ice-tea/tree/main/skills/web/jsonp-injection commit 72755d77d0

Frequently asked questions

npx skillmds@latest add zakirkun/jsonp-injection