newline injection in multipart/form-data

There's a funny but alone not very useful vulnerability in how browsers
handle names of multipart/form-data input fields. This affects MSIE and
Firefox, maybe others. You can use Javascript to set 'name' parameter of a
form field to a value that contains double quotes, newline characters,
etc, and this will be rendered as-is in the resulting request:

some_field.name = 'foo"\r\nEvil-header: baz="'

...renders it as:

Content-Disposition: form-data; name="foo"
Evil-header: baz=""; filename=""

The impact is limited by the fact you're bound by Content-Length of the
entire POST request, and to a lesser extent, by (often predictable) MIME
boundaries. As such, without an additional weakness in the proxy or WWW
server, it's probably not likely to cause that much of a trouble. Still,
maybe some readers will come up with something fancy?

/mz
Received on Mar 15 2007