mailing list archives
Re: Microsoft Internet Explorer Content-Disposition HTML File Handling Flaw
From: "Darren Bounds" <dbounds () gmail com>
Date: Tue, 11 Apr 2006 11:39:34 -0400
If a web-based application is relying on Content-Disposition to
seperate itself from the HTML file download, the application scope
will be exposed and open to attack. All the attacker needs is for the
victom to select "Open" at the File Download dialog (very common) and
the XSS attack will deliver it's payload (steal cookies, steal
application content, display a username/password dialog, redirect to
On 4/11/06, Steven Rakick <stevenrakick () yahoo com> wrote:
I don't see how this is a security issue...
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/