Are you content with our current attacks on Content-Type?

A presentation for BSides Las Vegas 2024.

Transcript

1. "SF
   ZPV
   DPOUFOU
   XJUI
   PVS
   DVSSFOU
   BUUBDLT
   PO
   $POUFOU5ZQF 
   B[BSB !B@[BSB@O FJ !FJ
   'MBUU
   4FDVSJUZ
   JOD
   
2. 6OFYQFDUFE
   QBUI
   GSPN
   )551
   SFTQPOTF
    VOFYQFDUFE
   BUUBDL
   QBUI
3. 4FMGJOUSPEVDUJPO
   FJ  &JKJ
   .PSJ
   
   FJ
   9
   !FJ
   'MBUU
   4FDVSJUZ
   JOD
   .VTDMF
   #SBJO
   
4. /PSJIJEF
   4BJUP
   
   B[BSB
   9
   !B@[BSB@O
   'MBUU
   4FDVSJUZ
   JOD
   4FMGJOUSPEVDUJPO
   B[BSB  IUUQTNJTDB[BSBKQ3&"%.&
5. 5PQJDT 
6. 
   8IBU
   JT
   $POUFOU5ZQF
   
   0ME
   BUUBDL
   QBUI
   JO
   )551
   SFTQPOTF
   
   /FX
   BUUBDL
   QBUI
   JO
   )551
   SFTQPOTF
   
   #VH
   #PVOUZ
   QSPHSBN
   SFTFBSDI
   
   044
   SFTFBSDI
   
   
   .JUJHBUJPOT 5PQJDT 
7. 
   
   8IBU
   JT
   $POUFOU5ZQF 
8. 8IBU
   JT
   $POUFOU5ZQF  
9. 8IBU
   JT
   $POUFOU5ZQF  
10. 8IBU
    JT
    $POUFOU5ZQF  
11. 8IBU
    JT
    $POUFOU5ZQF  
12. 8IBU
    JT
    $POUFOU5ZQF  
13. 8IBU
    JT
    $POUFOU5ZQF  
14. 
    
    0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF 
15. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
16. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
17. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
18. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
19. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF   &YUFOTJPO QOH
    KQH
    $POUFOU5ZQF JNBHFQOH
    JNBHFKQH
    .BHJD
    CZUF
20. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF   &YUFOTJPO QOH
    KQH
    $POUFOU5ZQF JNBHFQOH
    JNBHFKQH
    .BHJD
    CZUF
21. 0ME
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
22.  
    
    /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF
23. 8IBU
    JT
    0CKFDU
    4UPSBHF
     %BUB
    .FUBEBUB
24. 8IBU
    JT
    0CKFDU
    4UPSBHF
     %BUB
    .FUBEBUB $POUFOU5ZQF
25. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
26. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
27. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
28. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
29. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF   'PSHPU
    WBMJEBUJPO
30. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
31. /FX
    BUUBDL
    QBUI
    JO
    )551
    SFTQPOTF  
32. 
    
    #VH
    #PVOUZ
    QSPHSBN
    SFTFBSDI 
33. %JTDPWFSZ
    JO
    #VH
    #PVOUZ
    QSPHSBN   /P
    WBMJEBUJPO
34. %JTDPWFSZ
    JO
    #VH
    #PVOUZ
    QSPHSBN   /PU
    VTJOH
    4
35. %JTDPWFSZ
    JO
    #VH
    #PVOUZ
    QSPHSBN   "DDVSBUF
    WBMJEBUJPO
36. 
    
    044
    SFTFBSDI 
37. 
    
    $PEF
    TFBSDI 
38. $PEF
    TFBSDI  
39. $PEF
    TFBSDI  
40. $PEF
    TFBSDI   /P
    WBMJEBUJPO
    PS
    MBY
    WBMJEBUJPO
41. $PEF
    TFBSDI   /P
    WBMJEBUJPO
    PS
    MBY
    WBMJEBUJPO 😨
42.  
    
    /P
    WBMJEBUJPO
43. 
    
    
    /P
    WBMJEBUJPO
    JO
    )551
    SFRVFTU 
44. /P
    WBMJEBUJPO   /P
    WBMJEBUJPO
45. /P
    WBMJEBUJPO
    &YBNQMF
      
46. /P
    WBMJEBUJPO
    &YBNQMF
       6TF
    EJSFDU
    WBMVFT
47. /P
    WBMJEBUJPO
    &YBNQMF
      
48. /P
    WBMJEBUJPO
    &YBNQMF
       7BMJEBUJPO
    GSPOUFOE
    POMZ
49. /P
    WBMJEBUJPO
    &YBNQMF
       6QMPBE
    UFYUIUNM
50. 
    
    
    /P
    WBMJEBUJPO
    JO
    )551
    SFTQPOTF 
51. /P
    WBMJEBUJPO   /P
    WBMJEBUJPO
52. /P
    WBMJEBUJPO
    74$PEF
    &YUFOTJPO  
53. /P
    WBMJEBUJPO
    74$PEF
    &YUFOTJPO   (FU
    UFYUIUNM
54.  
    
    7BMJEBUJPO
    CZQBTT
55. 
    
    
    7BMJEBUJPO
    CZQBTT
    JO
    )551
    SFRVFTU 
56. 7BMJEBUJPO
    CZQBTT   -BY
    WBMJEBUJPO
57. 7BMJEBUJPO
    CZQBTT   -BY
    WBMJEBUJPO
58. #ZQBTT
    QBUUFSOT  Code Implementations Bypass Examples startsWith(“image/png”) image/png, text/html endsWith(“image/png”) text/html; image/png /^image\/png/ image/png, text/html includes(“image/png”) text/html; image/png
59. 7BMJEBUJPO
    CZQBTT
    $7&  
60. 7BMJEBUJPO
    CZQBTT
    $7&  
61. 7BMJEBUJPO
    CZQBTT
    $7&  
62. 7BMJEBUJPO
    CZQBTT
    $7&  
63. 7BMJEBUJPO
    CZQBTT
    $7&  
64. 7BMJEBUJPO
    CZQBTT
    $7&  
65. 7BMJEBUJPO
    CZQBTT
    $7&  
66. 7BMJEBUJPO
    CZQBTT
    $7&   #ZQBTT
    JNBHFQOH UFYUIUNM
67.  
    
    
    7BMJEBUJPO
    CZQBTT
    JO
    )551
    SFTQPOTF
68. 7BMJEBUJPO
    CZQBTT   -BY
    WBMJEBUJPO
69. 7BMJEBUJPO
    CZQBTT   -BY
    WBMJEBUJPO
70. 7BMJEBUJPO
    CZQBTT
    &MFDUSPO  
71. 7BMJEBUJPO
    CZQBTT
    &MFDUSPO   #ZQBTT
    JNBHFQOH UFYUIUNM
72. 7BMJEBUJPO
    CZQBTT
    $ISPNF
    &YUFOTJPO  
73. 7BMJEBUJPO
    CZQBTT
    $ISPNF
    &YUFOTJPO   #ZQBTT
    UFYUIUNMQEG
74. 
    
    .JUJHBUJPOT 
75. 4FDVSJUZ
    NFBTVSFT
    JO
    JNQMFNFOUBUJPO   z
76. 4FDVSJUZ
    NFBTVSFT
    JO
    JNQMFNFOUBUJPO   z
77.  5IBOL
    ZPV
    WFSZ
    NVDI
    GPS
    MJTUFOJOH
78. 3FGFSFODFT 
79. ◦ "NB[PO
    4
    ◦ IUUQTBXTBNB[PODPNKQT
    
    ◦ #MBDL'BO
    DPOUFOUUZQFSFTFBSDI
    ◦ IUUQTHJUIVCDPN#MBDL'BODPOUFOUUZQFSFTFBSDICMPC NBTUFS944NE
    ◦ $BSSJFSXBWF
    ◦ IUUQTHJUIVCDPNDBSSJFSXBWFVQMPBEFSDBSSJFSXBWF
    ◦ $7&
    ◦ IUUQTHJUIVCDPNDBSSJFSXBWFVQMPBEFSDBSSJFSXBWF TFDVSJUZBEWJTPSJFT()4"HYIYHGRIK 3FGFSFODF 
80. 23DPEF  IUUQTTQFBLFSEFDLDPNGMBUU@TFDVSJUZBSFZPVDPOUFOUXJUIPVSDVSSFOUBUUBDLTPODPOUFOUUZQF
81. #ZQBTT
    UFDIOJRVF   IUUQTCTJEFTUPLZPFOYTTVTJOHEJSUZDPOUFOUUZQFJODMPVEFSB
82. '"2 
83. 944
    5ISFBUT  4UPSFE
    944
84. &TTFOUJBM
    5IJOHT   /P
    WBMJEBUJPO