3 ms·
A commenter (@ivan2kh) raises a good question... what happens if you submit "evil.xml" on "https://www.amazon.com/clouddrive/share/xxx" https://www.amazon.com/
by jakear 9y ago
A commenter (@ivan2kh) raises a good question... what happens if you submit "evil.xml" on "https://www.amazon.com/clouddrive/share/xxx" https://www.amazon.com/clouddrive/share/xxx", or similar? Any host that allows user submitted files, and hosts them under their domain, could be exploited right?
- nsgi 9y agoServing user-submitted files from your main hostname is generally a bad idea because of the risk of XSS vulnerabilities. On Amazon cloud the content is served from the subdomain. Though it does raise a good point as a content domain/subdomain for a large website/service may have an impressive pagerank that could be exploited.
- jakear 9y agoarchive.org hosts with URL's like "https://archive.org/details/myfile.xml" https://archive.org/details/myfile.xml". They must have good pagerank for anything storage related. Perhaps a cloud storage service could use this exploit?