Reflected File Download: A New Web Attack Vector
drive.google.com
Reflected File Download: A New Web Attack Vector
1–10 of 81 posts
Re: Reflected File Download: A New Web Attack Vector
#2The linked document describes all the obvious parts that have been known foreer, but doesn't mention the interesting part: what webservices respond to user input (URL) by serving a previously nonexistent (server-side) document with a name derived from the URL.
Re: Reflected File Download: A New Web Attack Vector
#3> Having the ability to control some of the content that is returned by the server in the response body is crucial for an RFD exploit to be successful.
This sounds like an XSS attack against downloaded files as opposed to rendered HTML.
Re: Reflected File Download: A New Web Attack Vector
#4during the RFD research I discovered that all [Windows security] warnings are dismissed if one of the following strings appear in the filename:
- Install
- Setup
- Update
- Uninst
That's pretty amazing – is this still the case? It's obviously a deliberate decision, and seems to totally negate the value of those warnings.
Re: Reflected File Download: A New Web Attack Vector
#5The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters?
In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would parse it as a file download.
Re: Reflected File Download: A New Web Attack Vector
#6I found this presentation a bit more helpful to understand the concept
https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Re...
Re: Reflected File Download: A New Web Attack Vector
#7I think the author is claiming that clicking on https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g...
results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt.
Has anyone tried this on other browsers?
EDIT:
Here is the portion of the paper explaining why this no longer works:
"However, a common implementation error could result in Reflected File Download from the worst kind. Content-Disposition headers SHOULD include a "filename" parameter, to avoid having the browser parse the filename from the URL.
This is the exact problem that multiple Google APIs suffered from until I reported it to the Google security team, leading to a massive fix in core Google components."
Re: Reflected File Download: A New Web Attack Vector
#8"The user executes the file which contains shell commands that gain complete control over the computer."
Perhaps someone could verify the following.
If a user is logged in without privileges (not the admin user for example on Mac but a "standard user") then there is no (is there?) way to "gain complete control over the computer" without entering an admin user and password later in the process.
Typically I operate two (or more) logins under OSX. One is "standard" user and one is "admin" user. I only browse under "standard" user never under "admin" user. To me "admin" user really serves no purpose but needs to be there for obvious reasons.
This way I always have to enter the name of an admin user in order to install or make any system changes.
Further, from the command line I would need to do:
su [password]
and then
sudo -s [password]
Re: Reflected File Download: A New Web Attack Vector
#9I'm not sure I understand how this is "worm"-able - it still requires the user to manually execute the downloaded file? How is this any different from pasting a link to a "lol.jpg.exe" malware?
Re: Reflected File Download: A New Web Attack Vector
#10"The user executes the file which contains shell commands that gain complete control over the computer." Perhaps someone could verify the following. If a user is logged in without privileges (not the admin user for example on Mac but a "standard user") then there is no (is there?) way to "gain complete control over the computer" without entering an admin user and password later in the process. Typically I operate two…
An attacker can use a privilege escalation attack to execute as superuser, so even though there should be no way to "gain control of the entire computer" without the admin password, in practice this isn't the case.