Same Origin Method Execution (SOME) - Exploiting a Callback for Same Origin Policy Bypass
summary
A new exploit abuses JSONP callback parameters to execute methods inside a same-origin page by opening timed windows/frames, controlling the callback name (restricted to alpha-numeric+dot) and chaining actions like selectAll() then sendPhotos() to exfiltrate Google+ auto-backed-up photos to an attacker site. It bypasses X-Frame-Options, common CSP uses and many popup blockers, requires no click interaction, and makes any page on a domain vulnerable once one JSONP endpoint is exploitable. Reported to Google and paid (~$3k) as a high-impact bug.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:35Objectives
- 3:19Same Origin Policy
- 5:32What is Jason
- 7:14Jason with Padding
- 9:15Callback
- 15:46What else can you do
- 18:38Example
- 27:18Demo
- 29:43Protections
- 31:53Solutions
related talks
46mExploiting CORS Misconfigurations for Bitcoins and Bounties
36mHTML5 JS Security
34m"The magic of XSS - not only in web applications"
58mExploiting web messaging implementations
34mJS Security - A Pentesters Perspective
33mHacking The Front-End
28mBypassing Same-Origin Policy
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯