1

I'm playing around with a self-xss bug that I believe I can escalate with a CSRF attack. However, the exploit relies on sending two identical Content-Length headers in a single POST request.

Essentially, I'm looking for a piece of Javascript code that will make the visitor's browser issue a request that looks like this:

POST /authenticate[xss payload]
Host: target.net
Content-Length: 4
Content-Length: 4

whatever=whatever

It doesn't matter if the Content-Length is correct or not - there just has to be two identical Content-Length headers.

Sorry if the answer to this is trivial, I hope you can cut an infosec n00b some slack.

Improve this question
0

Content-length is a special header which can not be set using JavaScript in the first place, i.e. it is one of several forbidden header names. You might try HTTP request splitting to bypass this restriction but it is unlikely to work on modern browsers.

Improve this answer
2
  • Thanks for the response. I've been looker into this a bit more, and I've found that it also works with Content-Type and Content-Range headers (which are not forbidden header names according to your source). Is it possibly exploitable then?
    – weikop
    Sep 2 '19 at 15:03
  • @weikop: A sane browser would not allow to set these headers multiple times since it would not make sense. But the browsers might also decide to merge these headers as described here: "Each time you call setRequestHeader() after the first time you call it, the specified text is appended to the end of the existing header's content.". In short: likely not.
    – Steffen Ullrich
    Sep 2 '19 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.