Page MenuHomePhabricator

Lock MIME type configuration
ClosedPublic

Authored by epriestley on Mar 25 2015, 11:13 AM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 27 2024, 1:38 PM
Unknown Object (File)
Feb 5 2024, 8:48 AM
Unknown Object (File)
Feb 3 2024, 6:35 PM
Unknown Object (File)
Feb 3 2024, 5:49 PM
Unknown Object (File)
Feb 3 2024, 5:46 PM
Unknown Object (File)
Feb 3 2024, 5:11 PM
Unknown Object (File)
Jan 29 2024, 11:01 PM
Unknown Object (File)
Jan 20 2024, 2:31 AM
Subscribers

Details

Summary

Ref T6755. This mitigates an attack where you:

  • compromise an administrative account;
  • configure "text/plain" as an "image" MIME type; and
  • create a new macro sourced from a sensitive resource which is locally accessible over HTTP GET, using DNS rebinding.

You can then view the content of the resource in Files. By preventing the compromised account from reconfiguring the MIME types, the server will instead destroy the response and prevent the attacker from seeing it.

In general, these options should change very rarely, and they often sit just beyond the edge of security vulnerabilities anyway.

For example, if you ignore the warnings about an alternate file domain and elect to serve content from the primary domain, it's still somewhat difficult for an attacker to exploit the vulnerability. If they can add "text/html" or "image/svg+xml" as image MIME types, it becomes trivial. In this case not having an alternate domain is the main issue, but easy modification of this config increases risk/exposure.

Test Plan

Viewed affected config and saw that it is locked.

Diff Detail

Repository
rP Phabricator
Branch
lockmime
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 4971
Build 4989: [Placeholder Plan] Wait for 30 Seconds

Event Timeline

epriestley retitled this revision from to Lock MIME type configuration.
epriestley updated this object.
epriestley edited the test plan for this revision. (Show Details)
epriestley added a reviewer: btrahan.
btrahan edited edge metadata.
This revision is now accepted and ready to land.Mar 25 2015, 4:57 PM
This revision was automatically updated to reflect the committed changes.