UTF-7 Strikes 404 Pages In Internet Explorer
There’s been an interesting thread on bugtraq over the last few days around UTF-7 and Internet Explorer (if autodetection of character encoding is turned on) when submitting a file that is not there to a webpage hosted on an Apache server. Eiji James Yoshida disclosed this issue - which was partially already known (at least by a few people). The problem is that Internet Explorer builds a custom error page, so it’s not particularly useful by itself. I looked into this when I first put the UTF-7 vector on the XSS cheat Sheet
However, what Paul Szabo discovered is that if you make the URL at least 512 bytes in length it will no longer return IE’s custom 404 error page, but instead show you the actual error page that you requested:
http://[victim]/+ADw-SCRIPT+AD4-alert(’XSS’);+ADw-/SCRIPT+AD4-/ZZZ…
This equates to essentially a universally useful XSS exploit, given those conditions against an Apache server with default 404 error pages. Granted, it does require the automatic character set detection, but still. Pretty scary stuff. Looks like Apache needs to either start encoding the output or otherwise protecting itself from UTF-7 injection, and indeed Internet Explorer shouldn’t have character restrictions on displaying their custom 404 page. Either (or both) of those would fix the issue.
October 2nd, 2006 at 1:19 pm
I wouldn’t call Paul Szabo’s observation a discovery since it’s documented behavior on Microsoft’s website:
“…to see the exact text of an HTTP 500 response, the content length must be greater than or equal to 512 bytes. ”
http://support.microsoft.com/kb/294807/
October 2nd, 2006 at 2:09 pm
Thanks for the clarification, yawnmoth. It also might not work at all (I had to manually switch my encoding to get it to work)… I was talking with Brian Eaton about this and he had a good point. Here’s what he said:
I haven’t been able to verify other than doing it by hand.
October 2nd, 2006 at 2:24 pm
With a fresh Apache 1.3.36, the Content-Type header in a 404 response does indicate an encoding. My guess is that Brian Eaton is correct.
October 3rd, 2006 at 8:41 am
Well here it is from the horse’s mouth: