Subject: draft-abarth-mime-sniff, confused by Section 1

From: Julian Reschke <[email-masked]>
Date: Thu, 08 Apr 2010 16:58:25 +0200

Hi,

<http://tools.ietf.org/html/draft-abarth-mime-sniff-04#section-1> has:

    However, if a user agent does interpret a low-privilege media type,
    such as image/gif, as a high-privilege media type, such as text/html,
    the user agent has created a privilege escalation vulnerability in
    the server.

"in the server"? How does this affect the server?

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Sun, 11 Apr 2010 21:09:24 -0700

> "in the server"? How does this affect the server?

Because the user agent has misinterpreted what the server said.  On
the web, servers need to be careful what they say because the same
origin policy imbues their words (HTTP responses) with their
authority.  If a user agent misinterprets an image as HTML, the server
will become vulnerable to cross-site scripting.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Mon, 12 Apr 2010 15:56:54 +0200

On 12.04.2010 06:09, Adam Barth wrote:
> On Thu, Apr 8, 2010 at 7:58 AM, Julian Reschke<[email-masked]>  wrote:

I see what you mean, but I still think is misleading.

A server that relies on UAs implementing the same-origin policy will be 
vulnerable anyway. So the vulnerability is already there, it just 
becomes easier to exploit (compared, for instance, to attack the server 
using specially crafted scripts doing the HTTP request).

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Thu, 15 Apr 2010 12:09:20 -0700

On Mon, Apr 12, 2010 at 6:56 AM, Julian Reschke <[email-masked]> wrote:
> vulnerable anyway. So the vulnerability is already there, it just becomes
> easier to exploit (compared, for instance, to attack the server using
> specially crafted scripts doing the HTTP request).

I don't understand what you mean when you say "a server that relies on
UAs implementing the same-origin policy will be vulnerable anyway."
For example, bankofamerica.com relies on the UA implementing the
same-origin policy.  Is it vulnerable?  I guess the answer to that
question depends on which threats we're considering.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Thu, 15 Apr 2010 21:17:23 +0200

On 15.04.2010 21:09, Adam Barth wrote:
> ...
> ...

What I'm trying to say is that if a server relies in a client not doing 
certain things then it's vulnerable when a client does these things anyway.

So that could be hand-crafted client sending requests that a browser 
wouldn't send.

Maybe it just shows that most of my past I was involved in non-browser 
interactions over HTTP, so I'm trained not to rely on the niceness of 
clients.

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Thu, 15 Apr 2010 13:44:24 -0700

> interactions over HTTP, so I'm trained not to rely on the niceness of

Typically the way web sites defend themselves against these sorts of
threats is by authenticating the remote user agent, e.g. with a
cookie.  If a user want to use a non-standard user agent, they are
free to send whatever HTTP requests they like.  However, the damage
that these users can do is typically contained to messing with their
own account (e.g., bank account at bankofamerica.com).  Honest users,
like me, use a normal user agent and rely upon my user agent and
bankofamerica.com to protect my account.

Another way of looking at this situation is that your statement
applies equally well to cross-site scripting (XSS).  A server only has
to worry about XSS if they rely upon the UA to implement the
same-origin policy.  However, XSS is consistently ranked the #1
security problem for web applications (e.g.,
<http://www.owasp.org/index.php/Top_10_2007>).  Therefore, a great
many web applications must be relying upon the UA enforcing the
same-origin policy.

Adam