2

As far as I understand, a webapp is vulnerable to RFD (Reflected File Download) only when the header Content-Disposition: attachment which force the download is set in a response with JSON body,
but in any case we want to save a plain JSON file in the user computer ? and giving a significant name to this file via Content-Disposition: attachment; filename="whatever.txt" really mitigate the attack ?

0

As far as I understand, a webapp is vulnerable to RFD (Reflected File Download) only when the header Content-Disposition: attachment which force the download is set in a response with JSON body,

Not necessarily.

See for example this article which states that IE 8 and 9 will download all JSON as file, and that the download attribute on a link can be used to force a download in other browsers.

I tested this with a current version of Firefox, and at least there, it does not work cross origin (except via right-click -> save as). If you can post HTML links to the original origin, an attack is still possible using Firefox. I can't test on Chrome, but there it should work without that.

but in any case we want to save a plain JSON file in the user computer ?

An attacker wants to save a file on the users computer with a name - and extension - they control and with content they at least partially control, and they want this file to be delivered from a trusted domain (by the vulnerable application) so that a user will trust and execute it.

and giving a significant name to this file via Content-Disposition: attachment; filename="whatever.txt" really mitigate the attack ?

Yes. The idea of RFD is that an attacker can determine the filename of the file so that it contains a malicious extension. If you set the filename, that is not possible. I am not aware of any bypass which would allow an attacker to overwrite the given filename.

  • "IE 8 and 9 will download all JSON as file" Not sure if I got this point, do you mean that all IE will dowload all HTTP responses instead of showing the body to the user ?! ..... "If you can post HTML links to the original origin, an attack is still possible using Firefox" So the webapp must already be vulnerable to HTML Injection ? that's it ? – Reda LM Mar 20 '18 at 0:48
  • 1
    @Jessie Yes, if the content type is json, IE8/9 will always download it as a file. And if a content disposition attachment is not set, an attack in firefox only seems to be possible if you can post links (which you might call HTML injection) or with somewhat unlikely user interaction. – tim Mar 20 '18 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.