Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Michal Zalewski (lcamtufdione.ids.pl)
Date: Thu Mar 15 2007 - 07:25:40 CDT
There's a funny but alone not very useful vulnerability in how browsers
handle names of multipart/form-data input fields. This affects MSIE and
form field to a value that contains double quotes, newline characters,
etc, and this will be rendered as-is in the resulting request:
some_field.name = 'foo"\r\nEvil-header: baz="'
...renders it as:
Content-Disposition: form-data; name="foo"
Evil-header: baz=""; filename=""
The impact is limited by the fact you're bound by Content-Length of the
entire POST request, and to a lesser extent, by (often predictable) MIME
boundaries. As such, without an additional weakness in the proxy or WWW
server, it's probably not likely to cause that much of a trouble. Still,
maybe some readers will come up with something fancy?