2

I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible to misuse it for an XSS attack? My idea is to use lots of ranges to generate a XSS from a given file (if it is big enough and contains all necessary characters).

Request:

...
Range: bytes=x1-x2,x3-x4,x5-x6
...

We take only such ranges which we need to produce a new message. But the response looks like following:

Response:

--99999999999999999999<br>
Content-Type: application/x-javascript<br>
Content-Range: bytes x1-x2/FILE_SIZE<br>
<script>
--99999999999999999999<br>
Content-Type: application/x-javascript<br>
Content-Range: bytes x3-x4/FILE_SIZE<br>
alert
--99999999999999999999
Content-Type: application/x-javascript
Content-Range: bytes x5-x6/FILE_SIZE
('
--99999999999999999999--

Is it possible to disable (on client side) these additional lines so that the response won't be splitted as shown above: (?)

--99999999999999999999
Content-Type: application/x-javascript
Content-Range: bytes x5-x6/FILE_SIZE

Some set of byte ranges → <script>alert('XSS');</script>

3
  • 7
    How do you want to create such a range request in the first place and make the browser treat the result as HTML or script? Commented May 8, 2017 at 14:16
  • That is my question - if is it possible or not. It seems to me that it will be returned only as a plain text to the client without beeing executed. But even this would be somehow achieved (returned as plain text without additional lines) you'll still need another place where you can "import" this modified response. It seems to be useful only if you have somewhere "classic XSS" with some length limitation and/or other filters. Commented May 8, 2017 at 16:56
  • 1
    You will not be able to create a request like this inside the browser in the first place (outside of XHR which is no useful for XSS). Commented May 8, 2017 at 20:20

0

You must log in to answer this question.

Browse other questions tagged .