Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: [DAHAX-2013-001] Cloudflare XSS Vulnerability
From: jonathan schatz <jon () divisionbyzero com>
Date: Fri, 23 Aug 2013 11:31:31 -0700

On Aug 23, 2013, at 1:48 AM, Bart van Tuil <BvanTuil () descartes com> wrote:
Is it just me, or does it seem that **any** way to change the browser 
headers requires a degree of control that is same as, or higher than, 
the one we're trying to get?

I am sure there are a lot of ways (flash, javascript, objects) to 
modify headers. I just don't think it gets anyone anywhere.

Prereq > escalation? If someone finds an exception, I -am- listening ;)

Doesn't take away the fact that it's a nice find. Good going - thinking 
out of the box like this, Glenn.

the goal may be cache poisoning (in general, i can't comment on the cloudflare report), in which case modifying my own 
headers before a request is a perfectly reasonable attack vector. 


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]