3

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2:

Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8, ISO 8859-1).

What would be the threat of neglecting this requirement, and how could this be exploited?

  • 1
    UFT-7 XSS is one thing I can think of. – tim May 4 '16 at 19:57
  • UTF-7 XSS is a specific type of attack. This is one aspect of the vulnerability. Beware that the browser's decision, based on Content-Type HTTP headers and HTML meta tags, on how to interpret the characters can be vague. If the browser accepts a meta tag over the value of the header, just setting the encoding scheme doesn't fully solve encoding vulnerabilities; how the webapp ( the prog lang & s/w libraries) handle characters are where the true problem lies. Think: percent encoding, double encoding & NULL Byte Encoding. – eTo-san May 17 '16 at 16:03
6

Decrease client-side attacks.

For example : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding):

+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-

And It Is hard to Prevent XSS Attacks

more info : XSS with utf-7

1

The 2008 paper from Blake Franz of Leviathan Security -- http://www.leviathansecurity.com/white-papers/flirting-with-mime-types -- identifies some of the original problem spaces with character sets.

Some tools correctly identify and explain this problem, such as Burp Suite Professional -- https://portswigger.net/KnowledgeBase/Issues/Details/00800200_HTMLdoesnotspecifycharset

You will see mention of character sets in the OWASP Testing Guides on Stored XSS:

This design flaw can be exploited in browser MIME mishandling attacks. For instance, innocuous-looking files like JPG and GIF can contain an XSS payload that is executed when they are loaded by the browser. This is possible when the MIME type for an image such as image/gif can instead be set to text/html. In this case the file will be treated by the client browser as HTML.

Also consider that Internet Explorer does not handle MIME types in the same way as Mozilla Firefox or other browsers do. For instance, Internet Explorer handles TXT files with HTML content as HTML content. For further information about MIME handling, refer to the whitepapers section at the bottom of this chapter.

Further information can be found on the Wikipedia page under Charset Sniffing -- https://en.wikipedia.org/wiki/Content_sniffing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.