Java : Unsafe JavaScript framework
Classification
Overview
The application uses Ajax framework that opens access to valuable data for attackers when used incorrectly.
Framework Google Web Toolkit (GWT) uses JSON for data exchange between client and server. The framework generates responses containing valid JavaScript code that can be executed within the <script> tag. This may lead to JavaScript hijacking attacks.
Although the default GWT uses POST requests, which complicates the task of creating a malicious request from the <script> tag, the framework also contains mechanisms for work with GET requests. Moreover, many sources recommend using exectly GET requests to improve performance due to browser caching.
Similar considerations also apply to the Direct Web Remoting (DWR) framework 1.1.4 and earlier.