I recently read that the Flash plugin ignores the
Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that URL and load whatever it receives as a SWF file, with the permissions of the site that the content was loaded from — even if the response comes with a
Content-Type: text/plain header (or any other
Content-Type at all). The
Content-Type header can indicate that this is not a SWF file, and Flash will still load this as a Flash file. The content that's loaded doesn't even have to be a valid SWF file; it just has to start with a valid SWF file, and the Flash plugin will ignore any additional cruft that follows.
The source for this claim: http://126.96.36.199/blog/?p=242
If this is true, this is not good. It means that my site is vulnerable to XSS, if there is any page where the attacker can control the start of the page. It means that my site can be vulnerable even if I carefully set the
Content-Type header correctly everywhere. It means that the standard defenses against XSS when serving user-uploaded content are not sufficient.
For instance, if you want to allow the user to upload an arbitrary text file and serve it to anyone who asks, a standard approach is to make sure to set
Content-Type: text/plain on the response. It's widely believed that this is sufficient to be secure. If I understand this vulnerability correctly, this practice is not secure: a malicious user can upload a malicious text file containing the contents of a SWF file, and then cause it to be executed by the Flash plugin, creating the moral equivalent of a XSS vulnerability in the site.
This has me a bit gob-smacked. Is it really true? Does Flash really have this vulnerability? Has Flash been patched to fix this? Are there any mitigating factors? Is there any clean server-side defense to prevent this kind of attack?