SLIDE 1
MIME Types, XSS as a module MIME Types, XSS as a module and XSS as a standard and XSS as a standard
Hanno Böck Twitter: https://hboeck.de/ @hanno
1
2
MIME Types, XSS as a module MIME Types, XSS as a module and XSS as - - PowerPoint PPT Presentation
MIME Types, XSS as a module MIME Types, XSS as a module and XSS as - - PowerPoint PPT Presentation
MIME Types, XSS as a module MIME Types, XSS as a module and XSS as a standard and XSS as a standard Hanno Bck https://hboeck.de/ Twitter: @hanno 1 2 ACME http-01 validation ACME http-01 validation http://example.org/.well-known/acme-
SLIDE 2
SLIDE 3
ACME http-01 validation ACME http-01 validation
http://example.org/.well-known/acme- challenge/TOKEN1 Response: TOKEN1.TOKEN2
3
SLIDE 4
Some implementations reflect TOKEN1, thus this can lead to XSS. But only if the browser interprets it as HTML.
4
SLIDE 5
However, there is an old mod to Apache called Magic MIME that tries to figure out the content-type depending
- n the first bytes of the response. [...] For example <b>
would lead to content type text/html [...]
5
SLIDE 6
Wait, what?!? Wait, what?!?
6
SLIDE 7
Apache mod_mime_magic Apache mod_mime_magic
It's a module that enables XSS attacks.
7
SLIDE 8
Apache mod_mime_magic Apache mod_mime_magic
This module determines the MIME type of files in the same way the Unix file(1) command works: it looks at the first few bytes of the file. ( ) Apache documentation
8
SLIDE 9
mod_mime_magic parser mod_mime_magic parser
Parser code is based on an old fork of the "file" utility.
9
SLIDE 10
What does that mean? What does that mean?
If file extension is in /etc/mime.types use that. Else try to guess MIME type.
10
SLIDE 11
Any web application that allows uploading files with an unusual extension not in /etc/mime.types has Cross Site Scripting. (Found multiple examples, disclosure pending.)
11
SLIDE 12
Why? Why?
Upload file containing HTML and Javascript. Server will guess MIME type (e.g. if it starts with <html>) and send it as text/html.
12
SLIDE 13
Can we disable mod_mime_magic? Can we disable mod_mime_magic?
Only globally, no option to disable it per host or directory (can't be disabled by customers on shared hosting).
13
SLIDE 14
But if we disable mod_mime_magic But if we disable mod_mime_magic we're good? we're good?
Not so fast...
14
SLIDE 15
There's still the browser There's still the browser
It can guess MIME types, too!
15
SLIDE 16
If file with HTML is sent without a MIME type the browser will render it.
16
SLIDE 17
But there's But there's
X-Content-Type-Options: nosniff
17
SLIDE 18
So we can disable MIME sniffing in the So we can disable MIME sniffing in the browser? browser?
18
SLIDE 19
19
SLIDE 20
Firefox and Edge will render HTML without a MIME type even with "X-Content-Type-Options: nosniff".
20
SLIDE 21
What can web applications do? What can web applications do?
21
SLIDE 22
Only allow file extensions that are in Only allow file extensions that are in /etc/mime.types /etc/mime.types
Good luck with that: Every Linux distribution has its
- wn version of mime.types.
22
SLIDE 23
What could server administrators do? What could server administrators do?
23
SLIDE 24
Always send a MIME type? Always send a MIME type?
Let's set a safe MIME type (e.g. text/plain or application/octet-stream) for every unknown file extension.
24
SLIDE 25
Apache "DefaultType" Directive Apache "DefaultType" Directive
Has been removed in Apache 2.4.
25
SLIDE 26
WHY??? WHY???
26
SLIDE 27
W3C Standard Authoritative Metadata W3C Standard Authoritative Metadata
A standard to enable Cross Site Scripting.
27
SLIDE 28
W3C Standard Authoritative Metadata W3C Standard Authoritative Metadata
28
SLIDE 29
Soware doesn't have to follow stupid Soware doesn't have to follow stupid standards standards
nginx sends application/octet-stream by default.
29
SLIDE 30
Conclusions Conclusions
30
SLIDE 31
MIME sniffing - server and client side - MIME sniffing - server and client side - can easily lead to XSS. can easily lead to XSS.
31
SLIDE 32
Disable mod_mime_magic. It's Disable mod_mime_magic. It's inherently bad. inherently bad.
32
SLIDE 33
Web application developers have no Web application developers have no easy way of avoiding this issue. easy way of avoiding this issue.
33
SLIDE 34
X-Content-Type: nosniff doesn't help in X-Content-Type: nosniff doesn't help in half of the browsers. half of the browsers.
34
SLIDE 35
W3C standards tell us we aren't allowed W3C standards tell us we aren't allowed to mitigate this server-side. to mitigate this server-side.
35
SLIDE 36
This is a big mess This is a big mess
I'm hoping to get some ideas from you what to do about it.
36