[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
newline injection in multipart/form-data
There's a funny but alone not very useful vulnerability in how browsers
handle names of multipart/form-data input fields. This affects MSIE and
form field to a value that contains double quotes, newline characters,
etc, and this will be rendered as-is in the resulting request:
some_field.name = 'foo"\r\nEvil-header: baz="'
...renders it as:
Content-Disposition: form-data; name="foo"
Evil-header: baz=""; filename=""
The impact is limited by the fact you're bound by Content-Length of the
entire POST request, and to a lesser extent, by (often predictable) MIME
boundaries. As such, without an additional weakness in the proxy or WWW
server, it's probably not likely to cause that much of a trouble. Still,
maybe some readers will come up with something fancy?