Vulnerability Development mailing list archives
newline injection in multipart/form-data
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Thu, 15 Mar 2007 13:25:40 +0100 (CET)
There's a funny but alone not very useful vulnerability in how browsers handle names of multipart/form-data input fields. This affects MSIE and Firefox, maybe others. You can use Javascript to set 'name' parameter of a form field to a value that contains double quotes, newline characters, etc, and this will be rendered as-is in the resulting request: some_field.name = 'foo"\r\nEvil-header: baz="' ...renders it as: Content-Disposition: form-data; name="foo" Evil-header: baz=""; filename="" The impact is limited by the fact you're bound by Content-Length of the entire POST request, and to a lesser extent, by (often predictable) MIME boundaries. As such, without an additional weakness in the proxy or WWW server, it's probably not likely to cause that much of a trouble. Still, maybe some readers will come up with something fancy? /mz
Current thread:
- newline injection in multipart/form-data Michal Zalewski (Mar 15)