Back to list
newline injection in multipart/form-data
Mar 15 2007 12:25PM
Michal Zalewski (lcamtuf dione ids pl)
There's a funny but alone not very useful vulnerability in how browsers
handle names of multipart/form-data input fields. This affects MSIE and
form field to a value that contains double quotes, newline characters,
etc, and this will be rendered as-is in the resulting request:
some_field.name = 'foo"\r\nEvil-header: baz="'
...renders it as:
Content-Disposition: form-data; name="foo"
Evil-header: baz=""; filename=""
The impact is limited by the fact you're bound by Content-Length of the
entire POST request, and to a lesser extent, by (often predictable) MIME
boundaries. As such, without an additional weakness in the proxy or WWW
server, it's probably not likely to cause that much of a trouble. Still,
maybe some readers will come up with something fancy?
[ reply ]
Copyright 2010, SecurityFocus