MIME Types, XSS as a module MIME Types, XSS as a module and XSS as - - PowerPoint PPT Presentation

mime types xss as a module mime types xss as a module and
SMART_READER_LITE
LIVE PREVIEW

MIME Types, XSS as a module MIME Types, XSS as a module and XSS as - - PowerPoint PPT Presentation

MIME Types, XSS as a module MIME Types, XSS as a module and XSS as a standard and XSS as a standard Hanno Bck https://hboeck.de/ Twitter: @hanno 1 2 ACME http-01 validation ACME http-01 validation http://example.org/.well-known/acme-


slide-1
SLIDE 1

MIME Types, XSS as a module MIME Types, XSS as a module and XSS as a standard and XSS as a standard

Hanno Böck Twitter: https://hboeck.de/ @hanno

1

slide-2
SLIDE 2

2

slide-3
SLIDE 3

ACME http-01 validation ACME http-01 validation

http://example.org/.well-known/acme- challenge/TOKEN1 Response: TOKEN1.TOKEN2

3

slide-4
SLIDE 4

Some implementations reflect TOKEN1, thus this can lead to XSS. But only if the browser interprets it as HTML.

4

slide-5
SLIDE 5

However, there is an old mod to Apache called Magic MIME that tries to figure out the content-type depending

  • n the first bytes of the response. [...] For example <b>

would lead to content type text/html [...]

5

slide-6
SLIDE 6

Wait, what?!? Wait, what?!?

6

slide-7
SLIDE 7

Apache mod_mime_magic Apache mod_mime_magic

It's a module that enables XSS attacks.

7

slide-8
SLIDE 8

Apache mod_mime_magic Apache mod_mime_magic

This module determines the MIME type of files in the same way the Unix file(1) command works: it looks at the first few bytes of the file. ( ) Apache documentation

8

slide-9
SLIDE 9

mod_mime_magic parser mod_mime_magic parser

Parser code is based on an old fork of the "file" utility.

9

slide-10
SLIDE 10

What does that mean? What does that mean?

If file extension is in /etc/mime.types use that. Else try to guess MIME type.

10

slide-11
SLIDE 11

Any web application that allows uploading files with an unusual extension not in /etc/mime.types has Cross Site Scripting. (Found multiple examples, disclosure pending.)

11

slide-12
SLIDE 12

Why? Why?

Upload file containing HTML and Javascript. Server will guess MIME type (e.g. if it starts with <html>) and send it as text/html.

12

slide-13
SLIDE 13

Can we disable mod_mime_magic? Can we disable mod_mime_magic?

Only globally, no option to disable it per host or directory (can't be disabled by customers on shared hosting).

13

slide-14
SLIDE 14

But if we disable mod_mime_magic But if we disable mod_mime_magic we're good? we're good?

Not so fast...

14

slide-15
SLIDE 15

There's still the browser There's still the browser

It can guess MIME types, too!

15

slide-16
SLIDE 16

If file with HTML is sent without a MIME type the browser will render it.

16

slide-17
SLIDE 17

But there's But there's

X-Content-Type-Options: nosniff

17

slide-18
SLIDE 18

So we can disable MIME sniffing in the So we can disable MIME sniffing in the browser? browser?

18

slide-19
SLIDE 19

19

slide-20
SLIDE 20

Firefox and Edge will render HTML without a MIME type even with "X-Content-Type-Options: nosniff".

20

slide-21
SLIDE 21

What can web applications do? What can web applications do?

21

slide-22
SLIDE 22

Only allow file extensions that are in Only allow file extensions that are in /etc/mime.types /etc/mime.types

Good luck with that: Every Linux distribution has its

  • wn version of mime.types.

22

slide-23
SLIDE 23

What could server administrators do? What could server administrators do?

23

slide-24
SLIDE 24

Always send a MIME type? Always send a MIME type?

Let's set a safe MIME type (e.g. text/plain or application/octet-stream) for every unknown file extension.

24

slide-25
SLIDE 25

Apache "DefaultType" Directive Apache "DefaultType" Directive

Has been removed in Apache 2.4.

25

slide-26
SLIDE 26

WHY??? WHY???

26

slide-27
SLIDE 27

W3C Standard Authoritative Metadata W3C Standard Authoritative Metadata

A standard to enable Cross Site Scripting.

27

slide-28
SLIDE 28

W3C Standard Authoritative Metadata W3C Standard Authoritative Metadata

28

slide-29
SLIDE 29

Soware doesn't have to follow stupid Soware doesn't have to follow stupid standards standards

nginx sends application/octet-stream by default.

29

slide-30
SLIDE 30

Conclusions Conclusions

30

slide-31
SLIDE 31

MIME sniffing - server and client side - MIME sniffing - server and client side - can easily lead to XSS. can easily lead to XSS.

31

slide-32
SLIDE 32

Disable mod_mime_magic. It's Disable mod_mime_magic. It's inherently bad. inherently bad.

32

slide-33
SLIDE 33

Web application developers have no Web application developers have no easy way of avoiding this issue. easy way of avoiding this issue.

33

slide-34
SLIDE 34

X-Content-Type: nosniff doesn't help in X-Content-Type: nosniff doesn't help in half of the browsers. half of the browsers.

34

slide-35
SLIDE 35

W3C standards tell us we aren't allowed W3C standards tell us we aren't allowed to mitigate this server-side. to mitigate this server-side.

35

slide-36
SLIDE 36

This is a big mess This is a big mess

I'm hoping to get some ideas from you what to do about it.

36