[Full-disclosure] SDRF vulns in webapps and browsers
vladimir.vorontsov at onsec.ru
Sun Aug 22 20:04:55 BST 2010
This report describes a vulnerability type called SDRF. There are several
examples that demonstrate the risk of the above-mentioned class of
vulnerability. Causes of its existence and methods of protection from SDRF
are also observed in the report.
SDRF – the Same Domain Request Forgery. Like the known CSRF (Cross-Site
Request Forgery) vulnerability, SDRF falsifies HTTP requests of users, but
in contrast to CSRF, it forges the requests, that are send by a user to the
same domain, where the malicious code, that exploits the vulnerability, is
The second important difference is that SDRF is application-oriented.
While for a CDFR attack mainly unsafe HTML codes are used, SDRF attacks, in
opposite, are realized through Adobe © application formats, that are
processed by browser plug-ins, like Adobe Flash Player © and Adobe Reader
©. No doubt, SDRF can be used in classic way, for example by HTML
injections or XSS.
The third difference of SDRF from CSRF lies in the browsers’ specifics of
processing Adobe Flash Player © и Adobe Reader © documents. Even secured
resources, like Google Mail, Yandex Mail and many others are subjected to
SDRF vulnerability if the particular browser is used. A more detailed
description will be provided further.
Given all these differences we specified SDRF in a separate class of
vulnerabilities, though it is possible to classify them as a special case
Read more at attachment.
ONsec security expert
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 604879 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20100822/cc01be02/attachment-0001.pdf
Full-Disclosure is hosted and sponsored by Secunia.