--- type: Slides title: XSS using dirty Content Type in cloud era description: "Examines how HTTP Content-Type is parsed differently by RFC 9110 and the WHATWG Fetch standard, which splits the field on commas and takes the last media type, so values such as image/png,text/html defeat prefix, suffix, regex and substring allowlists. Cloud object storage makes this reachable: all three upload paths let the client set the stored Content-Type metadata, which the browser then honours. Two carrierwave advisories are traced, and exact-match validation is recommended." resource: "https://speakerdeck.com/flatt_security/xss-using-dirty-content-type-in-cloud-era?slide=21" tags: [slides, webseclist-reference, speaker-deck, xss, content-type, parser-differential, file-upload, mime, aws, ruby, cve, filter-bypass, owasp-a03-2021, owasp-a05-2021] generated: by: webseclist-refs/1 at: "2026-08-09T20:33:25+00:00" status: stable stale_after: 2027-08-09 sources: - id: original resource: "https://speakerdeck.com/flatt_security/xss-using-dirty-content-type-in-cloud-era?slide=21" title: XSS using dirty Content Type in cloud era author: Norihide Saito, Eiji Mori also_at: - "https://files.speakerdeck.com/presentations/eda5985e545a4ce09425758c6e727e09/BsidesTokyo_XSS_in_cloud_v3.pdf" - "https://bsides.tokyo/2024/#xss-using-dirty-content-type-in-cloud-era" authors: - Norihide Saito - Eiji Mori canonical_url: "" cited_by: - "2024.md:100" commit: "" content_sha256: 3118bef13f87796cb3f613be87143453d8421dafef544cb4b172de69459aefb7 depth: full depth_reason: default kind: slides language: "" licence: unknown original_url: "https://speakerdeck.com/flatt_security/xss-using-dirty-content-type-in-cloud-era?slide=21" published: "" publisher: Speaker Deck publisher_english: "" raw_sha256: 4a0b8737bee26b7f24dc4f918b5bb0336f8a496cb4c40226ff7c2cef3af0ef9c retrieved_from: "https://files.speakerdeck.com/presentations/eda5985e545a4ce09425758c6e727e09/BsidesTokyo_XSS_in_cloud_v3.pdf" retrieved_kind: stored retrieved_utc: "2026-08-09T20:33:25+00:00" slug: 2024-speaker-deck-xss-using-dirty-content-type-cloud-era snapshot: "" title_english: "" translation_file: "" translation_of: "" --- # XSS using dirty Content Type in cloud era **XSS using dirty Content Type in cloud era** - Norihide Saito, Eiji Mori, Speaker Deck. - Published: date not stated - Original: - Also published at: - Also published at: - Preserved from: https://files.speakerdeck.com/presentations/eda5985e545a4ce09425758c6e727e09/BsidesTokyo_XSS_in_cloud_v3.pdf (stored) on 2026-08-09 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. XSS using dir ty Content-Type in clou d er a 2024/3/30 azara(@a̲zara̲n)/ei(@ei01241) Flatt Security inc. 0. I ntr oduction あなた は奇 怪なCon tent-Typeを理解できますか? C a n you underst and the c uri o us C o nten t-Ty pe ? 2 How is it interpreted by the browser? image/png 3 How is it interpreted by the browser? image/png PNG file 4 How is it interpreted by the browser? text/html 5 How is it interpreted by the browser? text/html HTML file 6 How is it interpreted by the browser? text/html; image/png 7 How is it interpreted by the browser? text/html; image/png ? 8 How is it interpreted by the browser? text/html; image/png HTML file 9 How is it interpreted by the browser? text/html; image/png Switch 10 How is it interpreted by the browser? image/png; text/html PNG file 11 text/html(a 12 image/png; x=a,text/html text/html(a 13 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html text/html(a 14 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a 15 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png 16 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png 17 🤔 ....? image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png 🤔 HTML file? 18 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png ⭕ 🤔 HTML file? 19 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png 20 😱 Topics ○ Research surrounding Content-Type and XSS ○ New attack vectors emerge with the advent of the cloud. ○ Specification of Content-Type and Validation Bypass Tech ○ Example of "carrierwave" Ruby library ○ CVE-2023-49090 and CVE-2024-29034 ○ Security measures in implementation ○ Side Story …? Let's talk about the real and immediate threats we face after BSides Tokyo. (over drinks at the after party) 21 本題に入る前に自己紹介を Self Introducti on 22 Self-introduction Norihide Saito / azara Eiji Mori / ei @a̲zara̲n @ei01241 2020年に株式会社Flatt Securityに入社 鹿児島大学大学院修了後、2021年4月に株 し、Webアプリケーションやパブリッククラ 式会社Flatt Securityに入社。セキュリティ ウドを対象としたプロフェッショナルサービ エンジニアとして、主にWebアプリケーショ ス業務に従事。 ン診断とスマートフォンアプリケーション診 ISOG-J WG1などの外部団体での活動や、 断を担当している。 JSAC(2024)、AWS DevDay(2023)、 Security-JAWS DAYS(2023)での登壇・ワー 過去にセキュリティキャンプ関連イベント クショップ開催などを通し、パブリッククラ に関わっていたため、ハードウェアからソフ ウドとWebアプリケーションにおけるセキュ トウェアまで幅広く興味がある。趣味は脆弱 リティに関する啓蒙などの活動を行う。 性調査と筋トレ。 23 A little background on how we came to begin this Research ○ Many XSSs are now seen taking advantage of the characteristics of Object Storage and peripheral implementations. ○ Incredible Content-Type Movement Identified in CVE-2023-49090 and Other Vulnerabilities ○ Increased threats due to the increase in XSS attack vectors and the resulting ease of XSS ○ Possibility to obtain Tokens such as Access Token and Id Token from the browser ○ Become an attack gadget for services that issue Credentials, such as Amazon Cognito Identity Pool 24 1. Co nt en t-Typ e や そ の 周 辺 を 取 り 巻 く 研 究 とX SSについて Rese a rc h sur r oun di n g C o n t e n t -Ty p e a n d X SS 25 XSS originating from browser behavior and character encoding https://www.docswell.com/s/hasegawa/5LVVGZ-2022-03-14-211022#p18 https://www.docswell.com/s/ockeghem/ZX6P75-owasp20134021 趣味と実益の脆弱性発見 Mr. Yosuke Hasegawa 文字コードの脆弱性はこの3年間でどの程度対策されたか? Mr. Hiroshi Tokumaru 26 XSS originating from browser behavior and character encoding With the advent of X-XSS-Protection and awareness of the relevant methods Fixes and countermeasures will be implemented. https://www.docswell.com/s/hasegawa/5LVVGZ-2022-03-14-211022#p18 https://www.docswell.com/s/hasegawa/5LVVGZ-2022-03-14-211022#p18 趣味と実益の脆弱性発見 Mr. Yosuke Hasegawa 文字コードの脆弱性はこの3年間でどの程度対策されたか? Mr. Hiroshi Tokumaru 27 XSS pathway due to input values Data Store Conventional attack paths 1.User input exists and is output 2.Stored via one of the servers 3.Rendered by a terminal such as a browser 28 XSS pathway due to input values Data Store 29 XSS pathway due to input values Data Store 30 XSS pathway due to input values Data Store 31 XSS pathway due to input values Data Store 32 XSS pathway due to input values Data Store 33 XSS pathway due to input values Data Store 34 XSS pathway due to input values Content-Type had to be a specific MimeType such as text/html Data Store 35 XSS pathway due to input values Sanitization and escaping also increaseData the Store output. 36 XSS pathway caused by file uploads Disk Storage 37 XSS pathway caused by file uploads Disk Storage 38 XSS pathway caused by file uploads Disk Storage 39 XSS pathway caused by file uploads Disk Storage 40 XSS pathway caused by file uploads Disk Storage 41 XSS pathway caused by file uploads Disk Storage 42 XSS pathway caused by file uploads Disk Storage 43 XSS pathway caused by file uploads Disk Storage 44 XSS pathway caused by file uploads Disk Storage Extension(.png .jpg) Content-Type(image/png image/jpg) and other validation 45 Validation Example - File Upload 46 XSS pathway caused by file uploads Disk Storage If not allowed, return a value (e.g. application/octet-stream) or a validation error to ensure safe handling 47 XSS pathway caused by file uploads Disk Storage Content-Type: text/html 48 XSS pathway caused by file uploads Disk Storage Content-Type: text/html is invalid → Validation Error 49 XSS pathway caused by file uploads Disk Storage 50 XSS pathway caused by file uploads Was XSS a major factor in traditional file uploads? ○ When storing files on disk storage or delivering them, the Content- Type was sniffed by the middleware or application, and the attacker could not directly specify the Content-Type. ○ Validation was being done at upload time in the application and middleware, and they needed to be bypassed. Because of the above two points, file uploads in the form of disk storage were often more difficult to cause XSS as the years went by. 51 Research on Content-Type Precedents in this Research https://github.com/BlackFan/content-type-research/blob/master/XSS.md Content-Type Research by Mr. BlackFan 52 Research on Content-Type Precedents in this Research The interpretation of Content-Type was not the main topic of the study, as traditional application implementations have limited methods for specifying arbitrary Content-Types and retrieving them from the response. https://github.com/BlackFan/content-type-research/blob/master/XSS.md Content-Type Research by Mr. BlackFan 53 2. ク ラ ウドと新しい攻 撃 の 足 場 - O b ject S t o r a g e N e w att ack vec to rs em erg e w i t h t h e a dv e n t 54 Cloud (lift|sift|first) caused changes in application structure CDN/FrontServer Backend/Cloud 55 Cloud (lift|sift|first) caused changes in application structure CDN/FrontServer Backend/Cloud 56 Cloud (lift|sift|first) caused changes in application structure CDN/FrontServer Backend/Cloud 57 Wh at i s O b je c t Sto ra g e? 58 File Upload in cloud Disk storage Object storage 59 What Object Storage Object = Data(Binary) + Metadata ○ Metadata can be freely configured using the API. ○ Content-Type information can also be added as metadata. ○ Use cases ○ File Storage for Uploaded file ○ File Delivery 60 3 File Upload Methods Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 61 3 File Upload Methods Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 62 Server Side Upload for SDK 63 Server Side Upload for SDK 64 Server Side Upload for SDK 65 Server Side Upload for SDK 66 Server Side Upload for SDK Stored 67 Server Side Upload for SDK 68 3 File Upload Methods Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 69 Client Side Upload for Pre Signed URL 70 Client Side Upload for Pre Signed URL 71 Client Side Upload for Pre Signed URL 72 Client Side Upload for Pre Signed URL 73 Client Side Upload for Pre Signed URL 74 Client Side Upload for Pre Signed URL 75 Client Side Upload for Pre Signed URL Stored 76 Client Side Upload for Pre Signed URL 77 3 File Upload Methods Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 78 Client Side Upload for POST Policy 79 Client Side Upload for POST Policy 80 Client Side Upload for POST Policy 81 Client Side Upload for POST Policy 82 Client Side Upload for Pre Signed URL 83 Client Side Upload for Pre Signed URL Stored 84 Client Side Upload for Pre Signed URL 85 Ob ject S tora ge - XSS 101 86 Object Storage Object = Data(Binary) + Metadata ○ Metadata can be freely configured using the API. ○ Content-Type information can also be added as metadata. ○ Use cases ○ File Storage for Uploaded file ○ File Delivery 87 Object Storage of Upload Methods. Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 88 Object Storage of Upload Methods. Validation before uploading in the real world Extension Check (allow .png .jpeg .gif … more safe extensions) → 🙆 File Header Check → 🙆 Content-Type Check → 🤔 Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 89 Object Storage of Upload Methods. Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 90 Server Side Upload for SDK - XSS The SDK will explicitly give preference to the user passing a Content-Type, otherwise it will specify a specific Content-Type 91 Server Side Upload for SDK - XSS SDKは明示的にユーザーがContent-Typeを渡す場合には優先し、 そうでない場合には特定のContent-Typeを指定する 92 Server Side Upload for SDK - XSS Content-Type: text/html 93 Server Side Upload for SDK - XSS Extension Check → check 🙆 File Header Check → check 🙆 Content-Type Check → … no check 😴 94 Server Side Upload for SDK - XSS Content-Type: text/html 95 Server Side Upload for SDK - XSS Stored 96 Server Side Upload for SDK - XSS Content-Type: text/html 97 Server Side Upload for SDK - XSS Browsers render with the Content- Type specified by the server →XSS 98 Object Storage of Upload Methods. Server Side Upload Client Side Upload Client Side Upload for SDK for Pre Signed URL for POST Policy 99 Client Side Upload - XSS The SDK will explicitly give preference to the user passing a Content-Type, otherwise it will specify a specific Content-Type 100 Client Side Upload - XSS SDKは明示的にユーザーがContent-Typeを渡す場合には優先し、 そうでない場合には特定のContent-Typeを指定する 101 Client Side Upload - XSS 102 Client Side Upload - XSS Extension Check and Signed → OK 🙆 File Header Check and Signed → OK 🙆 Content-Type Check and Signed → … no 😴 103 Client Side Upload - XSS 104 Client Side Upload - XSS Change Content-Type: text/html In Proxy 105 Client Side Upload - XSS Stored 106 Client Side Upload - XSS HTTP Response Header “Content-Type: text/html” 107 Client Side Upload - XSS Browsers render with the Content- Type specified by the server →XSS 108 3. Spe cificat ion of Conten t-Typ e 109 Specification of Content-Type HTTP protocol and Semantics RFC 7231, RFC 8941, RFC 9110, and more WHATWG Fetch standard 110 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content RFC 8941 Structured Field Values for HTTP RFC 9110 HTTP Semantics WHATWG Fetch standard 111 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content Content-Type = media-type type "/" subtype *(OWS ";" OWS media-type = parameter = token "=" ( token / quoted-string ) quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE qdtext = HTAB / SP /%x21/%x23-5B/%x5D-7E / obs-text obs-text = %x80-FF 112 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content Content-Type = media-type type "/" subtype *(OWS ";" OWS media-type = parameter = token "=" ( token / quoted-string ) quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE qdtext = HTAB / SP /%x21/%x23-5B/%x5D-7E / obs-text obs-text = %x80-FF 113 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content 8.3.1. Considerations for New Header Fields Whether the field is a single value or whether it can be a list (delimited by commas; see Section 3.2 of [RFC7230]). If it does not use the list syntax, document how to treat messages where the field occurs multiple times (a sensible default would be to ignore the field, but this might not always be the right choice). Note that intermediaries and software libraries might combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). 114 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content Good Example: Content-Type: image/png;hoge=“fuga,text/html” → mediaType = image/png → parameters = ○ hoge = “fuga,text/html” Note that intermediaries and software libraries might combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). 115 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content Points to consider: Content-Type: image/png;hoge=fuga,text/html → mediaType = image/png 🤔 → parameters = ○ hoge = fuga Loo k at othe r sp ecif → ? = text/html icat ion s... Note that intermediaries and software libraries might combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). 116 Specification of Content-Type RFC 8941 Structured Field Values for HTTP Spec: sf-list = list-member *( OWS "," OWS list-member ) list-member = sf-item / inner-list Example: Example-List: sugar, tea, rum 3.1 Lists Lists are arrays of zero or more members, each of which can be an Item (Section 3.3) or an Inner List (Section 3.1.1), both of which can be Parameterized (Section 3.1.2). 117 Specification of Content-Type RFC 7231 HTTP/1.1: Semantics and Content Points to consider: Content-Type: image/png;hoge=fuga,text/html → mediaType = image/png, text/html 🤔 → parameters = ○ hoge = fuga text/html could be set to MediaType…? Note that intermediaries and software libraries might combine multiple header field instances into a single one, despite the field's definition not allowing the list syntax. A robust format enables recipients to discover these situations (good example: "Content-Type", as the comma can only appear inside quoted strings; bad example: "Location", as a comma can occur inside a URI). 118 Specification of Content-Type RFC 9110 HTTP Semantics Content-Type = media-type type "/" subtype *(OWS ";" OWS media-type = parameter = token "=" ( token / quoted-string ) quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE qdtext = HTAB / SP /%x21/%x23-5B/%x5D-7E / obs-text obs-text = %x80-FF 119 Specification of Content-Type RFC 9110 HTTP Semantics Content-Type = media-type type "/" subtype *(OWS ";" OWS media-type = Definition inherited from parameter = token "=" ( token / quoted-string ) RFC 7231(HTTP/1.1: Semantics and Content) quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE qdtext = HTAB / SP /%x21/%x23-5B/%x5D-7E / obs-text obs-text = %x80-FF 120 Specification of Content-Type RFC 9110 HTTP Semantics DQUOTE and “(),/:;<=>?@\[\\]{}" 👀 Content-Type Value is not explicitly marked “MUST NOT" or "SHOULD NOT → List Type Value may be available 5.6.2. Tokens Many HTTP field values are defined using common syntax components, separated by whitespace or specific delimiting characters. Delimiters are chosen from the set of US-ASCII visual characters not allowed in a token (DQUOTE and "(),/:;<=>?@\[\\]{}"). 121 Specification of Content-Type WHATWG Fetch standard Parse Logic for Content-Type 1. Let charset be null. 2. Let essence be null. 3. Let mimeType be null. 4. Let values be the result of getting, decoding, and splitting Content-Type from headers. 5. If values is null, then return failure. 6. For each value of values: 1. Let temporaryMimeType be the result of parsing value. 2. If temporaryMimeType is failure or its essence is "/", then continue. 3. Set mimeType to temporaryMimeType. 4. If mimeTypeʼs essence is not essence, then: 1. Set charset to null. 2. If mimeTypeʼs parameters["charset"] exists, then set charset to mimeTypeʼs parameters[“charset"]. 3. Set essence to mimeTypeʼs essence. 5. Otherwise, if mimeTypeʼs parameters["charset"] does not exist, and charset is non-null, set mimeTypeʼs parameters["charset"] to charset. 7. If mimeType is null, then return failure. 8. Return mimeType. 122 Specification of Content-Type WHATWG Fetch standard Pseudo-implementation with TypeScript Variables related to mimeType are mutable, so they are overwritten by For loop. 123 Specification of Content-Type WHATWG Fetch standard Parse Logic for Header Values 1. Let input be the result of isomorphic decoding value. 2. Let position be a position variable for input, initially pointing at the start of input. 3. Let values be a list of strings, initially empty. 4. Let temporaryValue be the empty string. 5. While position is not past the end of input: 1. Append the result of collecting a sequence of code points that are not U+0022 (") or U+002C (,) from input, given position, to temporaryValue. 2. If position is not past the end of input, then: 1. If the code point at position within input is U+0022 ("), then: 1. Append the result of collecting an HTTP quoted string from input, given position, to temporaryValue. 2. If position is not past the end of input, then continue. 2. Otherwise: 1. Assert: the code point at position within input is U+002C (,). 2. Advance position by 1. 3. Remove all HTTP tab or space from the start and end of temporaryValue. 4. Append temporaryValue to values. 5. Set temporaryValue to the empty string. 6. Return values. 124 Specification of Content-Type WHATWG Fetch standard Pseudo-implementation with TypeScript Comma(,) is used as the character used for division 125 Interpretation Difference for Specification Semicolon (;) RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png; text/html WHATWG: Content-Type: image/png; text/html 126 Interpretation Difference for Specification Semicolon (;) RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png; text/html MimeType is image/png WHATWG: Content-Type: image/png; text/html MimeType is image/png 127 Interpretation Difference for Specification Semicolon (;) Semicolon (;) is used to delimit parameters, so the RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png; text/html MimeType is image/png WHATWG: Content-Type: image/png; text/html MimeType is image/png 128 Interpretation Difference for Specification Comma(,) RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png, text/html WHATWG: Content-Type: image/png, text/html 129 Interpretation Difference for Specification Comma(,) RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png, text/html Undefined (Content-Type is defined as singular) WHATWG: Content-Type: image/png, text/html MimeType is text/html 130 Interpretation Difference for Specification Comma(,) Treats values as singular due to lack of interpretation definition. RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png, text/html Undefined (Content-Type is defined as singular) WHATWG: Content-Type: image/png, text/html MimeType is text/html 131 Example of code with inadequate implementation Code Implementation(Allow image/png) Bypass Example image/png, text/html Prefix match text/html; image/png Suffix match image/png, text/html Regex match Include text/html; image/png 132 4. CVE-2023-49090 and CVE-2024-29034 133 CVE-2023-49090 and CVE-2024-29034 CVE-2023-49090: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj CVE-2024-29034: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw 134 Carrierwave - File Upload - File Validation - etc.. 135 Carrierwave Stored Content-Type was registered in the metadata when the object was uploaded. 136 feature of Validation 137 CVE-2023-49090 - something was discovered 138 CVE-2023-49090 - Confirmation of implementation 139 CVE-2023-49090 - Confirmation of implementation 140 CVE-2023-49090 - Confirmation of implementation 141 CVE-2023-49090 - Confirmation of implementation image/png Response → 200 OK 142 CVE-2023-49090 - Confirmation of implementation text/html Response → 404 Not Found 143 CVE-2023-49090 - Confirmation of implementation aimage/png Response → 200 OK 144 CVE-2023-49090 - Confirmation of implementation 145 CVE-2023-49090 - Confirmation of implementation Iw re ant nd 🤔 er the it b as row te s xt er t /h o tm l 146 Interpretation Difference for Specification Semicolon (;) Semicolon (;) is used to delimit parameters, so the RFC9110: Pseudo-implementation with TypeScript Content-Type: image/png; text/html MimeType is image/png WHATWG: Content-Type: image/png; text/html MimeType is image/png 147 CVE-2023-49090 - Confirmation of implementation text/html; image/png Response → 200 OK 148 CVE-2023-49090 - Erroneous Fix Proposal My sincere apologies... 149 CVE-2023-49090 - Fix Proposal after Specification survey /\A#{item}/ StartsWith much image/png, text/html I can Bypass it. .... 150 CVE-2023-49090 - Fix Proposal after Specification survey image/png,text/html 😰 Response → 200 OK 151 CVE-2024-29034 - Fix 152 CVE-2024-29034 - Fix Content-Type: image/png,text/html 153 CVE-2024-29034 - Fix Content-Type: image/png,text/html changed to image/png by Marcel::Mimetype 154 CVE-2024-29034 - Fix Stored Metadata is set to a safe Content-Type 155 5. 対策 Secur ity meas ures in implementation 156 Security measures in implementation ○ Content-Type is an exact match ○ No partial matches are used ○ No startsWith ○ Determine the value of Content- ○ No endsWith type based on the information in ○ No includes the file ○ Be careful of unintended string ○ File Header matches when using regular ○ Extension expressions ○ Validation of the determined value ○ /^image/(png|jpeg|jpg|gif)$/ Use User Input Set Mechanically determined Value For Content-Type For Content-Type 157 Security measures in implementation Example - Server Side Validation with fixed values 158 Security measures in implementation Example - Server Side 159 Security measures in implementation Example - Server Side Content-Type: text/html 160 Security measures in implementation Example - Server Side Content-Type: text/html 161 Security measures in implementation Example - Server Side X 162 Security measures in implementation Example - Client Side The allowed Content-Types (e.g. image/png ) are pre-determined. 163 Security measures in implementation 164 Security measures in implementation 165 Security measures in implementation Example - Client Side 166 Security measures in implementation Example - Client Side Sign with a Content-Type Header with Validation and determined values. 167 Security measures in implementation 168 Security measures in implementation Change to Content-Type: text/html In Proxy 169 Security measures in implementation Verify signatures and reject if different 170 Security measures in implementation 171 Side Story - MimeType Sniffing 172 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png 173 🤔 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png unknown type? 174 🤔 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a ⭕ image(text\html/png unknown type? 175 😊 image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png 176 😊 H i ! ! Mim e Ty pe s n i ffe r image/png; x=a,text/html x/y,x/y,x/y,x/y,x/y,x/y,x/y,text/html image text/html text/html(a image(text\html/png r n i ffe s Ty pe e Mim 177 This is another story....... Thank you for your attention！ 178 Referenc e 179 Reference ○ Content-Security-Policy ○ https://developer.mozilla.org/ja/docs/Web/HTTP/Headers/Content-Security-Policy ○ Amazon S3 ○ https://aws.amazon.com/jp/s3/ ○ aws-sdk-js-v3 ○ https://github.com/aws/aws-sdk-js-v3 ○ signedURL ○ https://docs.aws.amazon.com/ja̲jp/IAM/latest/UserGuide/create-signed-request.html ○ Carrierwave ○ https://github.com/carrierwaveuploader/carrierwave ○ RFC7231 ○ https://datatracker.ietf.org/doc/html/rfc7231 ○ RFC8941 ○ https://datatracker.ietf.org/doc/html/rfc8941 ○ RFC9110 ○ https://datatracker.ietf.org/doc/html/rfc9110 ○ Fetch Standard ○ https://fetch.spec.whatwg.org ○ Bypassing and exploiting Bucket Upload Policies and Signed URLs ○ https://labs.detectify.com/writeups/bypassing-and-exploiting-bucket-upload-policies-and-signed-urls/ ○ Content-Type allowlist bypass vulnerability, possibly leading to XSS ○ https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj 180