Re: [DAHAX-2013-001] Cloudflare XSS Vulnerability

[jonathan schatz <jon () divisionbyzero com>]

On Aug 23, 2013, at 1:48 AM, Bart van Tuil <BvanTuil () descartes com> wrote:
> Is it just me, or does it seem that **any** way to change the browser 
> headers requires a degree of control that is same as, or higher than, 
> the one we're trying to get?
>
> I am sure there are a lot of ways (flash, javascript, objects) to 
> modify headers. I just don't think it gets anyone anywhere.
>
> Prereq > escalation? If someone finds an exception, I -am- listening ;)
>
> Doesn't take away the fact that it's a nice find. Good going - thinking 
> out of the box like this, Glenn.

the goal may be cache poisoning (in general, i can't comment on the cloudflare report), in which case modifying my own 
headers before a request is a perfectly reasonable attack vector. 

thanks,

-jon
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/