Anyone have other ideas on this? I've already implemented some code to
validate file input and its working. But is this the right approach?
Since it is an IE issue, you may as well be using HttpOnly cookies. It isn't a perfect fix, but maybe "good enough" for the meantime.
I think the fact that it's exploitable at even hotmail.com will prompt MS to do something quickly. I don't think it's reasonable to expect every two-bit web script to need to validate the integrity of image uploads. What about folk without the graphics libraries to accomplish this. Are there pure PHP/ASP scripts capable of doing this-- and can we place our trust in them?
The HTTP protocol is saying "Treat this as an image" and then IE goes ahead and "Uhh, you know what, I think I'm going to do my own thing here and execute some script". I'm kind of surprised this technique has been available all along and not reported until just now. Maybe I'm just overreacting.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
