Other nomination
Content Smuggling
The PDF specification lets the header appear anywhere in the first 1024 bytes, so a file can be a valid GIF and a valid PDF at once. Uploading such a polyglot to a site that only accepts benign types, then referencing it through an OBJECT tag with an application/pdf content type, hands it to Adobe Reader, whose XML APIs then make cookie-bearing requests against the hosting origin.
Record
- Researcher
- Billy Rios
- Published by
- xs-sniper.com
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Billy Rios, first published at the original source. Preserved copies are kept so the citation survives its host.