"filename" in Content-Disposition is a landmine - vulnerability caused by ambiguous requiremen
summary
Scans of multipart Content-Disposition handling across browsers, HTTP clients, frameworks and mail libraries uncover concrete flaws: about 80 targets tested, roughly 20 distinct vulnerabilities (RFD/reflected file download, CRLF header injection, multipart key overwrite) with exploitable cases in a browser and several clients/frameworks. Demonstrations include crafted filenames that overwrite other form fields, inject headers or produce malicious downloaded files (Firefox misclassifies a fuzzed filename), and long vendor delays in fixes. Defense: URL‑encode or otherwise escape CRLF, double-quote, NULL byte.
AI-written summary · about
chapters (18)
- 0:00Content-Disposition landmines
- 1:12RFC filename escaping ambiguity
- 2:21Characters to escape
- 3:46Content-Disposition in multipart
- 6:36Breaking Spring parser
- 10:11Exploiting Spring uploader
- 13:06Filename control attacks
- 17:29Reporting to Spring/Firefox
- 19:17Official escaping rules
- 23:16Research scope and causes
- 25:08CRLF and quote impacts
- 28:14HTTP parser vulnerabilities
- 29:20RCE via RFD in responses
- 31:12Email library flaws
- 32:39Web framework flaws
- 35:59Findings and risks
- 36:42Escape CRLF and quotes
- 37:26Q&A
related talks
50mReflected File Download - A New Web Attack Vector
50mModern WebApp Vulnerabilities
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
50mStranger Danger: Your Java Attack Surface Just Got Bigger
56mModern Web Vulnerabilities 2020
33mPDF - Mess With The Web
31mStranger Danger: Addressing Vulnerable CF Application Dependencies