News & Blog Is that your web site I smell? | Is that your web site I smell? |
|
Implemented in Internet Explorer 4 as a technique to improve the end user experience1, ‘MIME sniffing’ or MIME type detection helps the browser determine file formats on the web such as text, HTML, and audio/video2. However, when IE detects a conflict while MIME sniffing (i.e. it encounters an image that is really a script) potential vulnerabilities arise: [An] image that seems harmless at first glance may actually be dangerous if it begins with some HTML code, because Internet Explorer will then execute that code. This gives an attacker an opportunity to embed JavaScript in images and exploit the attack vector to execute cross-site scripting [(XSS)] attacks. [source] If your web site contains this type of “cloaked” file, then malicious code can be triggered when someone views your site. With the expansion of so much user-generated content these days, and the slow adoption of IE8 (which is not vulnerable to this exploit), the MIME sniffing feature has actually become a serious liability as users have increasing access to placing files (and images in particular) on web servers. For those of us who run and maintain Joomla web sites, the only real point of vulnerability in the core Joomla extensions is the upload feature in Media Manager. Of particular concern are the many Joomla-powered sites that allow registered users to submit content. When submitting an article, users can access the upload feature in Joomla by clicking the ‘Image’ button below the editor and thus potentially upload malicious file types as described above. Very few Joomla web sites stick with just the core extensions. In fact, the vast array of extensions for Joomla is one of the main benefits of the Joomla platform (Full disclosure: the author is a curator on the Joomla Extensions Directory team at Joomla.org). Many of these extensions take advantage of the Joomla API and when user input is needed, the same content editor used in the Joomla core is used in these extensions. For example, JCal Pro uses the Joomla content editor when users submit new events. Thus, there are numerous Joomla web sites that allow user input via a core extension or a third party extension that may be vulnerable to a XSS attack due to MIME sniffing in IE4 through IE7. Fortunately, there are a number of practical, common sense ways to protect your Joomla site from the MIME sniffing vulnerability depending on the goals and workflow on your site:
1In the early days of the internet (and even today on poorly configured web servers) it was not uncommon for the file format to be incorrectly identified by the browser. To reduce these errors and thus improve the user experience, Microsoft implemented ‘MIME sniffing’ (or MIME type detection) in Internet Explorer 4. MIME sniffing helps IE determine the file format of content that has been downloaded by comparing the file extension, file signature and the MIME type. When these 3 parameters match, things proceed as expected and the files are routed/rendered as appropriate. However, if there is a conflict between these parameters, IE renders the file according to the MIME type and this is where potential vulnerabilities arise. For example, what appears to be an image could be executed as an HTML file. 2Content on the internet is classified by the Internet media or MIME type, a standard to describe file formats on the Internet. When a file is served to a web browser, the browsers examine things like the file extension, file signature or MIME type to determine the appropriate action. For example, if a ZIP file is served, the browser may prompt the user to save the file. If an image is served, the browser will display the image. The following list represents some common MIME types all web developers and many web users will recognize:
Set as favorite
Bookmark
Email this
Hits: 3190 Comments (0)Subscribe to this comment's feedWrite comment |
|
| Last Updated ( Thursday, 18 June 2009 ) |
