Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without Content-Disposition header (i.e. files are shown in browser's window inlined)

However, other measures of security hygiene are still in place:

  • Files are served at another domain than the main site's content
  • Correct Content-Type and X-Content-Type-Options:nosniff exist

What are security risks of returning responses without Content-Disposition header?

share|improve this question
add comment

1 Answer

Depends what filetypes are allowed to be uploaded and how the files are being handled.

  • If the page is directly loaded, the file ends in .php and the webserver recognizes and executes PHP files, then you risk having the entire domain compromised.
  • A smaller issue is that an html file may be a phishing page, sending any results to a server controlled by the attacker (cross-domain posting via javascript may not be possible, but you can make any cross-domain request through (visible or invisible) forms). The domain and perhaps even HTTPS certificate clearly shows that it is on your domain or a subdomain (unless you use a completely different domain), and thus the user might think that the page is trustworthy.
  • And perhaps other things that don't come to mind right now.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.