joev_

So... on a crappier browser this would have worked? Heh, nice to know that they never bothered to open this in any modern browsers.

Absolutely true, but compared to android this is a rather good percentage.

From my testing, in stock android 3.1-4.1.2, the native browser has some java objects injected into it and is vulnerable, so any page on the internet could execute arbitrary code. You can verify yourself by downloading the SDK and trying the metasploit module on different targets. Of course with vendor patches it's anyone's guess as to what code is on a device, so it is very possible that some vendors have patched this in their older distributions. If you want to check your device, jduck put up a test script here:

http://www.droidsec.org/tests/addjsif/

Hey Egor, article author here. How come you are not such a fan of checking referer? It cannot be a global fix (some sites depend on serving xdomain scripts, have lots of users with proxies that alter headers etc), but it should work well for many cases no?

Yeah it's a neat attack. pretty glaring info leak imho. Even an empty array response can expose login status

Sorry, used the wrong term. I mean it can be injected as a script tag into an xdomain site.

Actually, ie is still vulnerable to a very similar attack in some cases, specifically you can leak responses containing small json array by inlining the json as a script[src=vbscript] tag. Disclosed here: http://en.wooyun.org/bugs/wooyun-2013-023

with the status "unable to contact the vendor or actively neglected by the vendor" :-/

Edit: I meant "injecting" not inlining. Thanks chc for pointing that out.