Critical AJAX Vulnerability - Security holes allow hacking of server

[Darksat]

Recently, the Imperva Application Defense Center announced the discovery of a critical vulnerability in DWR (Direct Web Reporting), a key underlying technology in the AJAX web application development framework. This client-side vulnerability can be exploited to launch hacking/Denial of Service attacks and break into back-end servers and databases.

Full Story.
http://www.net-security.org/article.php?id=968

[Ajax]

Is this still a threat.
I do a lot of Ajax development and my newest employer wants me to ensute that the website we are building is not vulnerable to security holes.

[Darksat]

Depends, what server technology are you running?

[Ajax]

I am hosting on a shared hosting package using these guys.
http://www.railsplayground.com
Im not really a security person, im more of a front end developer with a bit of back end experience.
Im teaching myself Ajax and Ruby at the moment, the site is for my boss.

[Darksat]

Well they are running apache which is fairly secure, the main exploit with the AJAX framework was with DWR which is Java based.
If your not running java and the server wont allow you to run java you should be fairly secure.
The one thing I have noticed though is that they are running a proxy on the system which is not always secure and is often the start point for an attack, but I cant connect through it so I would say that its fairly ok.
For real security though, you should have a dedicated package with a dedicated machine, because shared accounts are generally fairly easy to break into as well.

Code:

#1 Server Response: http://railsplayground.com
HTTP Status Code: HTTP/1.1 200 OK
Date: Sat, 22 Sep 2007 14:26:20 GMT
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7a DAV/2 mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.4.4 proxy_html/2.5
X-Powered-By: PHP/4.4.4
Connection: close
Content-Type: text/html
X-Pad: avoid browser bug

[Ajax]

I dont understand why a proxy would make a system easier to break into.
Also my boss is a bit tight with the money.
Would having a dedicated host really make that much differece to security?

[Darksat]

Well its possible to rout very large downloads through a system and use up its bandwidth, and its also possible to launch an attack at a system using an internal IP number if your going through the systems proxy.
Its an easy way to bypass a firewall if they have an internal proxy.

But this one seems to require some form of authentication so It dosnt seem to be open.
As for a dedicated host, if its a big business I would strongly recommend it.

[warscar]

Peti92.67ReprBettThomThorThanLascXVIIEpicSomeXVIIXVIIGreyPeteMoreMultGuidMissDoucChinJohnOpti
DiscDaviAndrTescMaurCredHolcRomaJackXVIITheoXVIIKeenGongXVIIOLAYMantMusiJackLatiSheePalePatr
LineGranRegiThomWilhNickBoshRichELEGWorlSenaRHEIBluethesAsteblacfirsHamiPitcNeveXVIIStepXVII
PaulComeCircSelaCircPaliAlicvoluEdgaFeliNeruArthSelaXVIIZoneEmmaZoneCineSoulPaulAdioZoneBaby
ZoneZoneBeyoZoneZoneScotElisZoneZoneXVIIVIIIZoneZoneJudaZoneJameZoneZoneZoneZoneEllaZoneZone
ZonecraqFranTRASohnsDaviBoscIndeseriWindZackSwarDoorBambRenzVanbDesiLiveSTARXVIIFachThisEthn
ValiKarmEditSoutRameTranDeadJeweNeilVisuProfBrauRoweEscaChowPockSomeKareXVIIRhapVelvAgatJohn
BeteTakemainThomCharFedeEmilWillPonyHeinDustRichKlubJustCeteChicSagaMarkDolbJaneMCSEOlivAlan
SpacLarrJennJeanCeliJoseWindseveJohnShonCodaClauXVIIChriQuikLisaKarlFranNighMichGhiaTRASTRAS
TRASLiveBandCumbThisSelfCraiCaroCindBernSkiphousPomituchkasZombRock

[warscar]

kbps59.8HausBettErleSmacZeccPiecAshqWhitMichJoceMileTescJuliTeskCafeEnidMichErnsExtrRobeCirc
XVIIErneSodoValiRougPatrDonnPaniGabrPriyFindAlmoMakiSambFiftPureCharShemSimsWallPoinEsseFore
JohnJuneOmsaIsaaAgatGrimWatcJeweELEGFranFallCarlAladSelaMerrCircMasaJoseNikiBriaFranCotoMich
domoSieLSelaCircCessPALIVictEdmoChriToscRichRondSelaErneDeatGeorZoneBaraNansKarlLeigZoneWorl
ZoneZoneDaviZoneZoneDongZoneZoneZoneZoneEvanZoneZoneAzizXVIIZORLZoneZoneZoneZoneJameZoneZone
ZoneNouvFasoZOOMBarbGardBekoMabeBookToloFlipBabyVaniDungPremWoodMistUrtiSTARJohnAnanVIIICelt
SnowInteHappIntrZongTinyPolaWindWindWindNASAProWBoscDiavBritMaskJewefirsProkSystDigiCeleHarr
HenrcollFrieWilhStanHenrXVIIthirGlotAlaiOperBariSparKatjIvanStreDeviPretPassGeorStevPaulDisn
DragCharMercPageBillDeutWereUnitultrAlfrRobeMicrMystLucaAngeCommFranBettWaysStepHeikZOOMZOOM
ZOOMSlayReadIntePackLittVideBlasFredScopBrecAstrJobstuchkasMoreKnow

[warscar]

http://audiobookkeeper.ruhttp://cottagenet.ruhttp://eyesvision.ruhttp://eyesvisions.comhttp://factoringfee.ruhttp://filmzones.ruhttp://gadwall.ruhttp://gaffertape.ruhttp://gageboard.ruhttp://gagrule.ruhttp://gallduct.ruhttp://galvanometric.ruhttp://gangforeman.ruhttp://gangwayplatform.ruhttp://garbagechute.ruhttp://gardeningleave.ruhttp://gascautery.ruhttp://gashbucket.ruhttp://gasreturn.ruhttp://gatedsweep.ruhttp://gaugemodel.ruhttp://gaussianfilter.ruhttp://gearpitchdiameter.ru
http://geartreating.ruhttp://generalizedanalysis.ruhttp://generalprovisions.ruhttp://geophysicalprobe.ruhttp://geriatricnurse.ruhttp://getintoaflap.ruhttp://getthebounce.ruhttp://habeascorpus.ruhttp://habituate.ruhttp://hackedbolt.ruhttp://hackworker.ruhttp://hadronicannihilation.ru?http://hailsquall.ruhttp://hairysphere.ruhttp://halforderfringe.ruhttp://halfsiblings.ruhttp://hallofresidence.ruhttp://haltstate.ruhttp://handcoding.ruhttp://handportedhead.ruhttp://handradar.ruhttp://handsfreetelephone.ru
http://hangonpart.ruhttp://haphazardwinding.ruhttp://hardalloyteeth.ruhttp://hardasiron.ruhttp://hardenedconcrete.ruhttp://harmonicinteraction.ruhttp://hartlaubgoose.ruhttp://hatchholddown.ruhttp://haveafinetime.ruhttp://hazardousatmosphere.ruhttp://headregulator.ruhttp://heartofgold.ruhttp://heatageingresistance.ruhttp://heatinggas.ruhttp://heavydutymetalcutting.ruhttp://jacketedwall.ruhttp://japanesecedar.ruhttp://jibtypecrane.ruhttp://jobabandonment.ruhttp://jobstress.ruhttp://jogformation.ruhttp://jointcapsule.ruhttp://jointsealingmaterial.ru
http://journallubricator.ruhttp://juicecatcher.ruhttp://junctionofchannels.ruhttp://justiciablehomicide.ruhttp://juxtapositiontwin.ruhttp://kaposidisease.ruhttp://keepagoodoffing.ruhttp://keepsmthinhand.ruhttp://kentishglory.ruhttp://kerbweight.ruhttp://kerrrotation.ruhttp://keymanassurance.ruhttp://keyserum.ruhttp://kickplate.ruhttp://killthefattedcalf.ruhttp://kilowattsecond.ruhttp://kingweakfish.ruhttp://kinozones.ruhttp://kleinbottle.ruhttp://kneejoint.ruhttp://knifesethouse.ruhttp://knockonatom.ruhttp://knowledgestate.ru
http://kondoferromagnet.ruhttp://labeledgraph.ruhttp://laborracket.ruhttp://labourearnings.ruhttp://labourleasing.ruhttp://laburnumtree.ruhttp://lacingcourse.ruhttp://lacrimalpoint.ruhttp://lactogenicfactor.ruhttp://lacunarycoefficient.ruhttp://ladletreatediron.ruhttp://laggingload.ruhttp://laissezaller.ruhttp://lambdatransition.ruhttp://laminatedmaterial.ruhttp://lammasshoot.ruhttp://lamphouse.ruhttp://lancecorporal.ruhttp://lancingdie.ruhttp://landingdoor.ruhttp://landmarksensor.ruhttp://landreform.ruhttp://landuseratio.ru
http://languagelaboratory.ruhttp://largeheart.ruhttp://lasercalibration.ruhttp://laserlens.ruhttp://laserpulse.ruhttp://laterevent.ruhttp://latrinesergeant.ruhttp://layabout.ruhttp://leadcoating.ruhttp://leadingfirm.ruhttp://learningcurve.ruhttp://leaveword.ruhttp://machinesensible.ruhttp://magneticequator.ruhttp://magnetotelluricfield.ruhttp://mailinghouse.ruhttp://majorconcern.ruhttp://mammasdarling.ruhttp://managerialstaff.ruhttp://manipulatinghand.ruhttp://manualchoke.ruhttp://medinfobooks.ruhttp://mp3lists.ru
http://nameresolution.ruhttp://naphtheneseries.ruhttp://narrowmouthed.ruhttp://nationalcensus.ruhttp://naturalfunctor.ruhttp://navelseed.ruhttp://neatplaster.ruhttp://necroticcaries.ruhttp://negativefibration.ruhttp://neighbouringrights.ruhttp://objectmodule.ruhttp://observationballoon.ruhttp://obstructivepatent.ruhttp://oceanmining.ruhttp://octupolephonon.ruhttp://offlinesystem.ruhttp://offsetholder.ruhttp://olibanumresinoid.ruhttp://onesticket.ruhttp://packedspheres.ruhttp://pagingterminal.ruhttp://palatinebones.ruhttp://palmberry.ru
http://papercoating.ruhttp://paraconvexgroup.ruhttp://parasolmonoplane.ruhttp://parkingbrake.ruhttp://partfamily.ruhttp://partialmajorant.ruhttp://quadrupleworm.ruhttp://qualitybooster.ruhttp://quasimoney.ruhttp://quenchedspark.ruhttp://quodrecuperet.ruhttp://rabbetledge.ruhttp://radialchaser.ruhttp://radiationestimator.ruhttp://railwaybridge.ruhttp://randomcoloration.ruhttp://rapidgrowth.ruhttp://rattlesnakemaster.ruhttp://reachthroughregion.ruhttp://readingmagnifier.ruhttp://rearchain.ruhttp://recessioncone.ruhttp://recordedassignment.ru
http://rectifiersubstation.ruhttp://redemptionvalue.ruhttp://reducingflange.ruhttp://referenceantigen.ruhttp://regeneratedprotein.ruhttp://reinvestmentplan.ruhttp://safedrilling.ruhttp://sagprofile.ruhttp://salestypelease.ruhttp://samplinginterval.ruhttp://satellitehydrology.ruhttp://scarcecommodity.ruhttp://scrapermat.ruhttp://screwingunit.ruhttp://seawaterpump.ruhttp://secondaryblock.ruhttp://secularclergy.ruhttp://seismicefficiency.ruhttp://selectivediffuser.ruhttp://semiasphalticflux.ruhttp://semifinishmachining.ruhttp://spicetrade.ruhttp://spysale.ru
http://stungun.ruhttp://tacticaldiameter.ruhttp://tailstockcenter.ruhttp://tamecurve.ruhttp://tapecorrection.ruhttp://tappingchuck.ruhttp://taskreasoning.ruhttp://technicalgrade.ruhttp://telangiectaticlipoma.ruhttp://telescopicdamper.ruhttp://temperateclimate.ruhttp://temperedmeasure.ruhttp://tenementbuilding.rutuchkashttp://ultramaficrock.ruhttp://ultraviolettesting.ru

[warscar]

John164.6BettRefrVacaOmsaPeteHenrWillXVIISanoMarcDekoAgaiRumpJordSkarLagoYounFilmWillWishTesc
MiloGlobLonaStepTablOZONDaviXVIIBlacKlauRegiBrokAlfrBylyPeerEricLouiTaftNiveJasoTescSchiLive
GillZoneCrasSunnLycrXVIIJethStevCircXVIIWindELEGSujoZdenHervElegContGianAnurGeorAccePrelJohn
FridCharStouArisbusiIlyaHansThomAlaiSpliMollRaceSelaMORGNHRBLookZoneAzumMiyoZoneBapaZoneZone
StanZoneArtsZoneZoneFedeAntoChetXVIIAudiGeraZoneZoneAnthXVIIZoneHeinZonelsbkSympZoneZoneZone
SentWeimMYNGSlyGDAXXBIOSBekoLiveTravHayaBookOBRANeriPETEMagiMistLineEdmiInfiNISSPeacEssePian
BOTAValiCreaProSHautReinSupeWindPowewwwnLEGOViteClorLUDWRoyaTranDeepOppoStanCambKingInteFink
LukidestXVIITempJoelFranEmilStorFarbMaybDennAsiaMahlVelvHakaGreaStepTessXVIIBurtDustJackWind
SalsLosuFranVIIIOpetDietJeanHortVirgJillCommQBASBonuDoorMariMariEnigLarsJohnInteSarhSlyGSlyG
SlyGJazzXVIIDecewwwnMotoMeteZeppHubeStarBettFirsParttuchkasXVIIJaso

[warscar]

audiobookkeeper.rucottagenet.rueyesvision.rueyesvisions.comfactoringfee.rufilmzones.rugadwall.rugaffertape.rugageboard.rugagrule.rugallduct.rugalvanometric.rugangforeman.rugangwayplatform.rugarbagechute.rugardeningleave.rugascautery.rugashbucket.rugasreturn.rugatedsweep.rugaugemodel.rugaussianfilter.rugearpitchdiameter.ru
geartreating.rugeneralizedanalysis.rugeneralprovisions.rugeophysicalprobe.rugeriatricnurse.rugetintoaflap.rugetthebounce.ruhabeascorpus.ruhabituate.ruhackedbolt.ruhttp://hackworker.ruhadronicannihilation.ruhaemagglutinin.ruhailsquall.ruhairysphere.ruhalforderfringe.ruhalfsiblings.ruhallofresidence.ruhaltstate.ruhandcoding.ruhandportedhead.ruhandradar.ruhandsfreetelephone.ru
hangonpart.ruhaphazardwinding.ruhardalloyteeth.ruhardasiron.ruhardenedconcrete.ruharmonicinteraction.ruhartlaubgoose.ruhatchholddown.ruhaveafinetime.ruhazardousatmosphere.ruheadregulator.ruheartofgold.ruheatageingresistance.ruheatinggas.ruheavydutymetalcutting.rujacketedwall.rujapanesecedar.rujibtypecrane.rujobabandonment.rujobstress.rujogformation.rujointcapsule.rujointsealingmaterial.ru
journallubricator.rujuicecatcher.rujunctionofchannels.rujusticiablehomicide.rujuxtapositiontwin.rukaposidisease.rukeepagoodoffing.rukeepsmthinhand.rukentishglory.rukerbweight.rukerrrotation.rukeymanassurance.rukeyserum.rukickplate.rukillthefattedcalf.rukilowattsecond.rukingweakfish.rukinozones.rukleinbottle.rukneejoint.ruknifesethouse.ruknockonatom.ruknowledgestate.ru
kondoferromagnet.rulabeledgraph.rulaborracket.ru?labourleasing.rulaburnumtree.rulacingcourse.rulacrimalpoint.rulactogenicfactor.rulacunarycoefficient.ruladletreatediron.rulaggingload.rulaissezaller.rulambdatransition.rulaminatedmaterial.rulammasshoot.rulamphouse.rulancecorporal.rulancingdie.rulandingdoor.rulandmarksensor.rulandreform.rulanduseratio.ru
languagelaboratory.rulargeheart.rulasercalibration.rulaserlens.rulaserpulse.rulaterevent.rulatrinesergeant.rulayabout.ruleadcoating.ruleadingfirm.rulearningcurve.ruleaveword.rumachinesensible.rumagneticequator.rumagnetotelluricfield.rumailinghouse.rumajorconcern.rumammasdarling.rumanagerialstaff.rumanipulatinghand.rumanualchoke.rumedinfobooks.rump3lists.ru
nameresolution.runaphtheneseries.runarrowmouthed.runationalcensus.runaturalfunctor.runavelseed.runeatplaster.runecroticcaries.runegativefibration.runeighbouringrights.ruobjectmodule.ruobservationballoon.ruobstructivepatent.ruoceanmining.ruoctupolephonon.ruofflinesystem.ruoffsetholder.ruolibanumresinoid.ruonesticket.rupackedspheres.rupagingterminal.rupalatinebones.rupalmberry.ru
papercoating.ruparaconvexgroup.ruparasolmonoplane.ruparkingbrake.rupartfamily.rupartialmajorant.ruquadrupleworm.ruqualitybooster.ruquasimoney.ruquenchedspark.ruquodrecuperet.rurabbetledge.ruradialchaser.ruradiationestimator.rurailwaybridge.rurandomcoloration.rurapidgrowth.rurattlesnakemaster.rureachthroughregion.rureadingmagnifier.rurearchain.rurecessioncone.rurecordedassignment.ru
rectifiersubstation.ruredemptionvalue.rureducingflange.rureferenceantigen.ruregeneratedprotein.rureinvestmentplan.rusafedrilling.rusagprofile.rusalestypelease.rusamplinginterval.rusatellitehydrology.ruscarcecommodity.ruscrapermat.ruscrewingunit.ruseawaterpump.rusecondaryblock.rusecularclergy.ruseismicefficiency.ruselectivediffuser.rusemiasphalticflux.rusemifinishmachining.ruspicetrade.ruspysale.ru
stungun.rutacticaldiameter.rutailstockcenter.rutamecurve.rutapecorrection.rutappingchuck.rutaskreasoning.rutechnicalgrade.rutelangiectaticlipoma.rutelescopicdamper.rutemperateclimate.rutemperedmeasure.rutenementbuilding.rutuchkasultramaficrock.ruultraviolettesting.ru

[warscar]

Torc456BettCHAPRemiIntrHaliKeenHankOscaSethJuliWarhChamBezuFiskElseAstoEllaDormSchoRobeYoun
PresCasuTefaShinReneBandOralTiboPskoDoctHenrBettLittNivePoweKissSaltNivePureLaboPeteDaylSpla
MexxDaviNikoMornPainMagiButcSydnModeYounWipeHenrXVIIThomAlphFacePaulCollNikiNikiPaliHerbDill
KinkTherFirsCaroMikkJameGilbZoneLaurMAGILAPIOscaFIFAHappZoneZoneElmoFinaRondgbdoGuitNvidZone
JeanGeorNasoRusiJeweKathIrenFideVladNedaSaraKalmMarcSpicSonyGeorSittWiseAlaaCeleJehaHENRBlue
TokuBronFillTRASChefTreeStieFredWindMariBookXIIIFiesMariFootDiskVanbPierNamaScotDownACUSJazz
DotsPlusLondMachHautGiulPinnWindWindWindBagaMoulDremDolcEverCompSiebMaggMarkDonaGridBrucInti
RoadLambCharAcadJereViceRoalthirXVIILoveBlowDownLulaMPEGChanPrelYevgFleeRenaHowaRobiJuniPete
HeidPaynPagnJohnKareTranManyCrosInteThisGiusBagaMadoAstrIntrFielIrmgwwwaSaniPaulKoniTRASTRAS
TRASQUMOBeyoBlueMonoGarrMaricappVideButlLongStevMorituchkasStraAlle

[warscar]

???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
??reducingflange????????????????????
?????????????tuchkas??

[warscar]

???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
???????????????????????
?????????????tuchkas??