5 ms·
Any ideas to prevent cross-site hacks that use IE's MHTML redirection bug?
- benhoyt 19y agoI've just been tightening up our upcoming microPledge website -- http://micropledge.com http://micropledge.com -- to prevent cross-site request forgery (CSRF). I added a random SHA as a form key to each form. But! Then I discovered this lovely IE security hole. An attacker can use cross-domain JavaScript and an mhtml: redirect to grab the page, get the form key, and then do the POST. Brilliant! Anyone have any experience in getting around this? (To test the vulnerability in your browser, go to http://secunia.com/Internet_Explorer_Arbitrary_Content_Disclosure_Vulnerability_Test/ http://secunia.com/Internet_Explorer_Arbitrary_Content_Disclosure_Vulnerability_Test/ -- my copy of IE6 was vulnerable, IE7 wasn't, and Fx doesn't support mhtml so it's not.)
- palish 19y agoEasy. Don't use IE6. Really.. Stuff like this isn't about 'not supporting IE6'. It's about the time spent not being worth it. :)
- inklesspen 19y agoHow are you going to keep your users from using IE6?
- benhoyt 19y agoAha, answered my own question. :-) Trust Google to have the solution. IE parses the first part of an MHTML document as HTTP-style headers, so if you have an HTML comment at the start of your pages with "Content-Type: Something crazy" followed by a blank line, that fixes it. Google Reader has this (just after the doctype): <!-- Content-type: Preventing XSRF in IE. --> Do a view source on http://www.google.com/reader/m/view/ http://www.google.com/reader/m/view/ and try it (you have to be logged in). I found this out at these links: http://sla.ckers.org/forum/read.php?4,1975,2037 http://sla.ckers.org/forum/read.php?4,1975,2037 http://sla.ckers.org/forum/read.php?4,9628,10259 http://sla.ckers.org/forum/read.php?4,9628,10259