3 ms·
This exploit seems to require a <script> tag. But if you let your users insert a <script> tag into any text field, this exploit is the least of your worries. W
by kijin 12y ago
This exploit seems to require a <script> tag.
But if you let your users insert a <script> tag into any text field, this exploit is the least of your worries. Why encode your attack into a GIF file when you can just open a <script> tag and attack away in the comfort of a WYSIWIG editor?
A more interesting attack vector is the static HTML file that the attacker used as a vehicle for his <script> tag. If your users can upload an HTML file, or any other file that the browser might display as an HTML document (IE loves to guess the content type), you are vulnerable to XSS, no matter how thoroughly you filter all the other form fields.
One of the easiest ways to mitigate this vulnerability is to force browsers to download/save all user-uploaded files instead of displaying them. Configure your file server to add a Content-Disposition: attachment; header to all user-uploaded files.
- Drakim 12y ago> One of the easiest ways to mitigate this vulnerability is to force browsers to download/save all user-uploaded files instead of displaying them. Configure your file server to add a Content-Disposition: attachment; header to all user-uploaded files. But I can imagine many scenarios were the whole purpose of letting the user upload images is so that you can inline display them on the web (such as a forum avatar picture). Requiring the manual downloading of the image wouldn't be an acceptable solution for most people there.
- kijin 12y agoIf you use a proper <img> tag to embed an image in a webpage, it will display correctly even if the server sets a Content-Disposition header to force download. The header only makes a difference when you explicitly navigate to the URL of the user-uploaded resource.