[Full-disclosure] Microsoft Internet Explorer Content-Disposition HTML File Handling Flaw

[Darren Bounds]

Steve,

If a web-based application is relying on Content-Disposition to
seperate itself from the HTML file download, the application scope
will be exposed and open to attack. All the attacker needs is for the
victom to select "Open" at the File Download dialog (very common) and
the XSS attack will deliver it's payload  (steal cookies, steal
application content, display a username/password dialog, redirect to
goatse.cx, etc).

Get it?


Thank you,

Darren Bounds

On 4/11/06, Steven Rakick <stevenrakick at yahoo.com> wrote:
> I don't see how this is a security issue...
>