the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 485
If the application blocks the uploaded file, try to use various file extensions,
including .txt and .jpg. If the application accepts a file containing HTML when
you use a different extension, it may still be vulnerable, depending on exactly
how the file is delivered during download. Web mail applications are often
vulnerable in this way. An attacker can send e-mails containing a seductivesounding
image attachment that in fact compromises the session of any user
who views it.
Even if the application returns a Content-Type header specifying that the
downloaded file is an image, some browsers may still process its contents as
HTML if this is what the file actually contains. For example:
HTTP/1.1 200 OK
Content-Length: 25
Content-Type: image/jpeg
alert(1)
Older versions of Internet Explorer behaved in this way. If a user requested a
.jpg file directly (not via an embedded tag), and the preceding response
was received, IE would actually process its contents as HTML. Although this
behavior has since been modified, it is possible that other browsers may behave
this way in the future.
Hybrid File Attacks
Often, to defend against the attacks described so far, applications perform
some validation of the uploaded file’s contents to verify that it actually contains
data in the expected format, such as an image. These applications may
still be vulnerable, using “hybrid files” that combine two different formats
within the same file.
One example of a hybrid file is a GIFAR file, devised by Billy Rios. A GIFAR
file contains data in both GIF image format and JAR (Java archive) format and
is actually a valid instance of both formats. This is possible because the file
metadata relating to the GIF format is at the start of the file, and the metadata
relating to the JAR format is at the end of the file. Because of this, applications
that validate the contents of uploaded files, and that allow files containing GIF
data, accept GIFAR files as valid.
An uploaded file attack using a GIFAR file typically involves the following
steps:
n The attacker finds an application function in which GIF files that are
uploaded by one user can be downloaded by other users, such as a user’s
profile picture in a social networking application.
n The attacker constructs a GIFAR file containing Java code that hijacks the
session of any user who executes it.