Imperva Discovers Critical Vulnerability in AJAX Technology; Web 2.0 Applications at Risk

Business Wire, Jan 3, 2007

Application Defense Center Identifies Major Flaw in Next Generation Web Application Framework

Imperva

WHO: Amichai Shulman, CTO, Imperva
     Mr. Shulman is head of the Imperva Application Defense Center
     (ADC), the company's web application and database vulnerability
     research group

WHAT: The ADC today announced the discovery of a critical
      vulnerability in DWR (Direct Web Reporting), a key underlying
      technology in the AJAX web application development framework.
      This client-side vulnerability can be exploited to launch Denial
      of Service (DoS) attacks and break into back-end servers and
      databases. AJAX is emerging as the new lingua franc for building
      new generation Web 2.0 applications such as Google Maps. Since
      AJAX executes a much larger proportion of application logic in
      the web browser than traditional web applications, it exposes a
      broader attack surface to client-side exploits used by attackers
      to target sensitive back-end servers directly. The ADC has
      published a free security advisory that details the DWR
      vulnerability and how to mitigate attacks. Amichai Shulman,
      head of the ADC, is available to discuss this vulnerability as
      well as AJAX/Web 2.0 security issues.

WHERE: The ADC Security Advisory on the DWR vulnerability is available
       at: http://www.imperva.com/application_defense_center/papers/w
       eb20-ajax-dwr-01032007.html

WHEN: Mr. Shulman is available for interviews immediately via
      teleconference

HOW: Please contact Marc Gendron at 781-237-0341 or marc@mgpr.net to
     arrange a call with Mr. Shulman.

About the Imperva Application Defense Center

The Imperva Application Defense Center (ADC) is internationally-recognized for its leadership in security and compliance research and education. The Imperva ADC has found over 20 vulnerabilities in commercial Web application and database products. Database and application vendors have credited the organization with the discovery of serious vulnerabilities and mitigation techniques that have led to increased security in their products.

About Imperva

Imperva is the global leader in data security and compliance solutions for the data center. The company's SecureSphere database and web application appliances are deployed in leading financial, retail, telecommunications, healthcare, and government organizations around the globe. Founded over four years ago, Imperva is a solid, privately held company with growing revenues and backing from Accel Partners, Greylock Partners, US Venture Partners, and Venrock Associates. For more information, visit www.imperva.com.