[B! security][JSON] nsyeeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

nsyee id:nsyee

securityã¨JSONã«é–¢ã™ã‚‹nsyeeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
nsyee 2013/11/08
javascript

JSON

XSS

security
ãƒªãƒ³ã‚¯
JSONã‚’vbscriptã¨ã—ã¦èªã¿è¾¼ã¾ã›ã‚‹JSONãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯(CVE-2013-1297)ã«æ³¨æ„
ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘æ°ã®ãƒ–ãƒã‚°ã‚¨ãƒ³ãƒˆãƒªã€Œæ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«ã¯ X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã‚‹ã¹ãã€ã«ã¦ã€å·§å¦™ãªç½ ã‚’ä»•æŽ›ã‘ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€åˆ¥ãƒ‰ãƒ¡ã‚¤ãƒ³ã®JSONãƒ‡ãƒ¼ã‚¿ã‚’vbscriptã¨ã—ã¦èªã¿è¾¼ã¿ã€ã‚¨ãƒ©ãƒ¼ãƒãƒ³ãƒ‰ãƒ©çµŒç”±ã§æ©Ÿå¯†æƒ…å ±ã‚’ç›—ã¿å‡ºã™ã¨ã„ã†æ‰‹æ³•ãŒç´¹ä»‹ã•ã‚Œã¾ã—ãŸã€‚ã“ã‚Œã¯ã€IEã®è„†å¼±æ€§CVE-2013-1297ã‚’æ‚ªç”¨ã—ãŸã‚‚ã®ã§ã€MS13-037ã«ã¦è§£æ¶ˆã•ã‚Œã¦ã„ã¾ã™ãŒã€MS13-037ã¯IE6ï½žIE8ãŒå¯¾è±¡ã§ã‚ã‚Šã€IE9ä»¥é™ã§ã¯è§£æ¶ˆã•ã‚Œã¦ã„ã¾ã›ã‚“ã€‚ ã¾ãŸã€MS13-037ã‚’é©ç”¨ã„ã¦ã„ãªã„IE6ï½žIE8ã®åˆ©ç”¨è€…ã‚‚ã—ã°ã‚‰ãæ®‹ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã‚‹ã“ã¨ã‹ã‚‰ã€ã“ã®å•é¡Œã‚’è©³ã—ãèª¬æ˜Žè‡´ã—ã¾ã™ã€‚ã‚µã‚¤ãƒˆå´ã®å¯¾ç–ã®å‚è€ƒã«ã—ã¦ä¸‹ã•ã„ã€‚ å•é¡Œã®æ¦‚è¦ JSONå½¢å¼ã®ãƒ‡ãƒ¼ã‚¿ã¯ã€é€šå¸¸ã¯XMLHttpRequestã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã«ã‚ˆã‚Šèªã¿å‡ºã—ã¾ã™ãŒã€æ”»æ’ƒè€…ãŒç½ ã‚µã‚¤ãƒˆã‚’ä½œæˆã—ã¦ã€vbscript
nsyee 2013/05/20
javascript

JSON

security
ãƒªãƒ³ã‚¯
è£œè¶³ç·¨ï¼šæ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«ã¯ X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã‚‹ã¹ã - è‘‰ã£ã±æ—¥è¨˜
ã€Œæ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«ã¯ X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã‚‹ã¹ã - è‘‰ã£ã±æ—¥è¨˜ã€ã®è£œè¶³ç·¨ã§ã™ã€‚ çµå±€ã€ã‚ˆãã‚ã‹ã‚‰ãªã„ã‚“ã ã‘ã©ã€‚ ã‚ˆãã‚ã‹ã‚‰ãªã„å ´åˆã¯ã€ã¨ã«ã‹ãå…¨ã¦ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã« X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã¾ã—ã‚‡ã†ã€‚ æ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«X-Content-Type-Options:nosniffã‚’ã¤ã‘ã‚‹ç†ç”±ã¯ã‚ã‹ã£ãŸã‘ã©ã€ã€Œã‚ã‚‰ã‚†ã‚‹ã€ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«ã¤ã‘ã‚‹ç†ç”±ã¯ãªãœï¼Ÿ æ©Ÿå¯†æƒ…å ±ã‚’å«ã¾ãªãã¦ã‚‚ã€<script>ã®ã‚ˆã†ãªæ–‡å—åˆ—ã‚’å«ã‚€ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’IEã§ç›´æŽ¥é–‹ã„ãŸå ´åˆã«ã¯XSSã«ã¤ãªãŒã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚Šã¾ã™ã€‚ã©ã®ã‚ˆã†ãªã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«X-Content-Type-Options:nosniffãŒå¿…è¦ã‹ã‚’è€ƒãˆã‚‹ãã‚‰ã„ã§ã‚ã‚Œã°ã€å…¨ã¦ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«ä»˜ä¸Žã—ãŸã»ã†ãŒé–“é•ã„ãŒãªãã¦ã„ã„ã§ã—ã‚‡ã†ã€ã¨ã„ã†ã“ã¨ã§ã™ã€‚ IEã®ãŸã‚ã ã‘ã®å•
nsyee 2013/05/19
javascript

JSON

security
ãƒªãƒ³ã‚¯
æ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€JSONã«ã¯ X-Content-Type-Options: nosniff ã‚’ã¤ã‘ã‚‹ã¹ã - è‘‰ã£ã±æ—¥è¨˜
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã„ã¦JSONã‚’ç”¨ã„ã¦ãƒ–ãƒ©ã‚¦ã‚¶ - ã‚µãƒ¼ãƒé–“ã§ãƒ‡ãƒ¼ã‚¿ã®ã‚„ã‚Šå–ã‚Šã‚’è¡Œã†ã“ã¨ã¯ã‚‚ã¯ã‚„æ™®é€šã®ã“ã¨ã§ã™ãŒã€ã“ã®ã¨ãJSONå†…ã«ç¬¬ä¸‰è€…ã«æ¼ã‚Œã¦ã¯å›°ã‚‹æ©Ÿå¯†æƒ…å ±ãŒå«ã¾ã‚Œã‚‹å ´åˆã¯ã€å¿…ãš X-Content-Type-Options: nosniff ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã‚’ã¤ã‘ã‚‹ã‚ˆã†ã«ã—ã¾ã—ã‚‡ã†(ã‚€ã—ã‚æ©Ÿå¯†æƒ…å ±ã‹ã©ã†ã‹ã«é–¢ã‚ã‚‰ãšã€å…¨ã¦ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«ã¤ã‘ã‚‹ã»ã†ãŒã‚ˆã„ã€‚é–¢é€£:X-Content-Type-Options: nosniff ã¤ã‹ã‚ãªã„ã‚„ã¤ã¯æ»ãã°ã„ã„ã®ã«! - è‘‰ã£ã±æ—¥è¨˜)ã€‚ ä¾‹ãˆã°ã€æ©Ÿå¯†æƒ…å ±ã‚’å«ã‚€ä»¥ä¸‹ã®ã‚ˆã†ãªJSONé…åˆ—ã‚’è¿”ã™ãƒªã‚½ãƒ¼ã‚¹(http://example.jp/target.json)ãŒã‚ã£ãŸã¨ã—ã¾ã™ã€‚ [ "secret", "data", "is", "here" ] æ”»æ’ƒè€…ã¯ç½ ãƒšãƒ¼ã‚¸ã‚’ä½œæˆã—ã€ä»¥ä¸‹ã®ã‚ˆã†ã«JSONé…åˆ—ã‚’vbscriptã¨ã—ã¦èªã¿è¾¼ã¿ã¾ã™ã€‚ã‚‚ã¡ã‚
nsyee 2013/05/19
javascript

JSON

security
ãƒªãƒ³ã‚¯
ãªãœGoogleã¯JSONã®å…ˆé ã« while(1); ã‚’ã¤ã‘ã‚‹ã®ã‹ - Qiita
while(1);[['u',[['smsSentFlag','false'],['hideInvitations','false'],['remindOnRespondedEventsOnly','true'],['hideInvitations_remindOnRespondedEventsOnly','false_true'],['Calendar ID stripped for privacy','false'],['smsVerifiedFlag','true']]]] ã“ã‚Œä»¥å¤–ã«ã‚‚Googleã®ã‚µãƒ¼ãƒ“ã‚¹ã§ã¯ &&&START&&& ã¨ã‹ while(1); &&&START&&& ã¦ã®ãŒå…ˆé ã«å…¥ã£ã¦ãŸã‚Šã™ã‚‹ã‚“ã ã‘ã©ã€ã“ã‚Œã¯ä¸€ä½“ä½•ï¼Ÿ è§£ç” ã“ã‚Œã¯ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ»ãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªå¯¾ç–ã€‚ ä¾‹ãˆã°GoogleãŒ gmail.com/json?action=inbox ã¨ã„ã†URL
nsyee 2013/02/06
google

JSON

CSRF

security
ãƒªãƒ³ã‚¯
Amon2ã¨JSONã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ - tokuhirom's blog
[1]http://d.hatena.ne.jp/ockeghem/20110907/p1[2]http://www.atmarkit.co.jp/fcoding/articles/webapp/05/webapp05a.html[3] http://msdn.microsoft.com/ja-jp/asp.net/ff713315[4] http://labs.cybozu.co.jp/blog/kazuho/archives/2007/01/cross-site_including.phpã‚ãŸã‚Šã‚’ã‚ˆã‚“ã§ã€JSON ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¤ã„ã¦ã‹ã‚“ãŒãˆã¦ã¿ãŸã€‚ ã“ã“ã§ã€æœ‰åŠ¹ã¨ã•ã‚Œã¦ã„ã‚‹å¯¾ç–ã®ã†ã¡ while(1); ã‚’å…ˆé ã«ä»˜ä¸Žã™ã‚‹POST ã§ã™ã¹ã¦å‡¦ç†ã™ã‚‹ã¨ã„ã£ãŸã‚ãŸã‚Šã¯ã€RESTful ã§ãªã„ã—ã€BK æ„ŸãŒã²ã©ã„ã¨ã„ã†ã‹æœ¬è³ªçš„ã§ã¯ãªã„ã®ã§ã§ãã‚‹ã ã‘ã‚„ã‚ŠãŸããªã„ã€‚ ã¾ãŸã€Amon2 ã§ã¯äº’æ›
nsyee 2011/11/25
Perl

JSON

security
ãƒªãƒ³ã‚¯
JSONãƒ‡ãƒ¼ã‚¿ã‚’ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚¢ã‚¿ãƒƒã‚¯ã‹ã‚‰å®ˆã‚‹ãŸã‚ã«while(1)ã‚’ä½¿ã†ã“ã¨ã‚’ã‚„ã‚ã¾ã—ã‚‡ã† - hoshikuzu | star_dust ã®æ›¸æ–Ž
ã“ã‚Œã¯ãªã« æ—¢ã«ã”å˜çŸ¥ã®æ–¹ãŒã„ã‚‰ã£ã—ã‚ƒã‚‹ã‹ã©ã†ã‹ã‚‚çŸ¥ã‚Šã¾ã›ã‚“ãŒä»Šã•ã£ãé–¢é€£æ–‡çŒ®ã«è¡Œãå½“ãŸã£ã¦é©šæ„•ã—ãŸã®ã§å¿µã®ãŸã‚ã«ãƒ¡ãƒ¢ã‚’æ›¸ã„ã¦ãŠãã¾ã™ã€‚ç§ã¯ãƒ¡ãƒ¼ãƒªãƒ³ã‚°ãƒªã‚¹ãƒˆãªã©ã«åŠ å…¥ã—ã¦ã„ã¾ã›ã‚“ã®ã§è«–è°ãŒæ¸ˆã‚“ã§ã„ã‚‹ã‹ã©ã†ã‹ã‚‚çŸ¥ã‚‰ãªã„ã®ã§ã™ã€‚ã‚‚ã—ã‚‚ã‚¦ã‚§ãƒ–ä¸Šã«è§£èª¬è¨˜äº‹ãŒã‚ã‚‹ã‚ˆã†ã§ã—ãŸã‚‰é€†ã«ç§ã«æ˜¯éžã¨ã‚‚æ•™ãˆã¦ãã ã•ã„ã€‚ JSONãƒ‡ãƒ¼ã‚¿ã®å…ˆé ã« JSONãƒ‡ãƒ¼ã‚¿ã®å…ˆé ã«while(1)ã‚’ç½®ã„ã¦ãŠãã“ã¨ã§ç„¡é™ãƒ«ãƒ¼ãƒ—ã‚’ç™ºç”Ÿã•ã›ã¦ãŠã„ã¦ã€å—å‹•çš„æ”»æ’ƒã®ãƒšãƒ¼ã‚¸ã®æ‚ªæ„ã‚ã‚‹scriptã®å®Ÿè¡Œã‚’å¤±æ•—ã•ã›ã‚‹ã¨ã„ã†ã‚¢ã‚¤ãƒ‡ã‚¢ã«ã¯æ¬ ç‚¹ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ã‚’ã€å…ˆç¨‹ã¨ã‚ã‚‹æ–‡çŒ®ã‹ã‚‰çŸ¥ã‚Šã¾ã—ãŸã€‚ã“ã‚Œã¯while(true)ã«ã¤ã„ã¦ã‚‚åŒæ§˜ã§ã™ã€‚JavaScriptã¯æŸ”è»Ÿã§å¼·åŠ›ãªè¨€èªžã§ã™ã‹ã‚‰ã€ãƒ–ãƒ©ã‚¦ã‚¶ãŒJavaScriptã‚¨ãƒ³ã‚¸ãƒ³ã‚’ã¾ã˜ã‚ã«å®Ÿè£…ã—ã¦ã„ã‚‹ã®ã§ã‚ã‚Œã°ã€ã‚¢ã‚¿ãƒƒã‚¯ã®ãƒãƒ£ãƒ³ã‚¹ã‚’ä¸Žãˆã¦ã„ã‚‹ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ã—ã‹ã—ã“ã‚Œã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã¨ã¯æ‰ãˆã‚‰ã‚Œã¾ã›ã‚“
nsyee 2009/03/27
javascript

JSON

security
ãƒªãƒ³ã‚¯
1