(SYS-CON Media) – Does JavaScript, which was never intended to do anything resembling what it does within the approach now called AJAX, have a fundamental design flaw? That's the question being asked by Stefano Di Paola and Giorgio Fedon. By using a new technique called "Prototype Hijacking," Di Paola and Fedon claim, it has been shown how it is possible to sniff and manipulate in real time asynchronous requests originating from any browser in a way which is transparent and independent from the framework used.

Their paper, "Subverting AJAX," was written for the 23rd Chaos Communication Conference, which took place at the Berliner Congress Center from 27-30 December, 2006. The conference has a weblog here: 23C3 Weblog.

The authors - Stefano Di Paola describes himself as a Senior Security Engineer while Fedon is currently employed as senior security consultant and penetration tester at Emaze Networks - conclude with the following thought, in somewhat broken English:

"As it seems, Web 2.0 applications will be more and more tightly tied to browser security, that is increasing in complexity and has to take care of a plethora of features that can be turned into weapons if controlled by a malicious attacker."

They describe what they call "a very interesting cache-injection technique" that permits attacks against the way asynchronous requests are made to be leveraged in a way that allows an attacker to poison almost permanently the web sites visited and stored into browser cache.

They also describe a new type of attack that bypasses even "restrictions imposed by web sites not vulnerable to XSS."

Experts however aren't  convinced. One who has checked the Opera, Safari and (Gecko-based) Camino browsers, writing on Slashdot, reports that they all "have completly separate sets of prototypes for each frame, so you can't circumvent XSS protection using prototypes."

As the Slashdot poster comments: "So it seems there's nothing to get excited about - you must have exploitable XSS vulnerability to begin with, so it's not the end of the internet just yet."

• AJAX & Security: Vulnerability in DWR Security Logic Identified