2

I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible to misuse it for an XSS attack? My idea is to use lots of ranges to generate a XSS from a given file (if it is big enough and contains all necessary characters).

Request:

...
Range: bytes=x1-x2,x3-x4,x5-x6
...

We take only such ranges which we need to produce a new message. But the response looks like following:

Response:

--99999999999999999999<br>
Content-Type: application/x-javascript<br>
Content-Range: bytes x1-x2/FILE_SIZE<br>
<script>
--99999999999999999999<br>
Content-Type: application/x-javascript<br>
Content-Range: bytes x3-x4/FILE_SIZE<br>
alert
--99999999999999999999
Content-Type: application/x-javascript
Content-Range: bytes x5-x6/FILE_SIZE
('
--99999999999999999999--

Is it possible to disable (on client side) these additional lines so that the response won't be splitted as shown above: (?)

--99999999999999999999
Content-Type: application/x-javascript
Content-Range: bytes x5-x6/FILE_SIZE

Some set of byte ranges → <script>alert('XSS');</script>

  • 7
    How do you want to create such a range request in the first place and make the browser treat the result as HTML or script? – Steffen Ullrich May 8 '17 at 14:16
  • That is my question - if is it possible or not. It seems to me that it will be returned only as a plain text to the client without beeing executed. But even this would be somehow achieved (returned as plain text without additional lines) you'll still need another place where you can "import" this modified response. It seems to be useful only if you have somewhere "classic XSS" with some length limitation and/or other filters. – Awaaaaarghhh May 8 '17 at 16:56
  • 1
    You will not be able to create a request like this inside the browser in the first place (outside of XHR which is no useful for XSS). – Steffen Ullrich May 8 '17 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.