Content-Type juggling
Last updated
Was this helpful?
Last updated
Was this helpful?
Content-Type juggling exploits the lack of checking on the Content-Type header when submitting an HTTP request.
Most of the time, Content-Type juggling is a way to carry out other attacks such as or (see ).
If the security header is present, it will be difficult to perform the Content-Type juggling, as indicated in . The XCTO security header can be used to indicate that the MIME types advertised in the Content-Type headers should be followed and not be changed by the browser depending on the page's content. Websites that implement this security header with the nosniff directive must also include a valid Content-Type header in their responses.
In order to identify if the target is vulnerable to Content-Type juggling, testers need to answer the following questions :
Is there a post request with value(s) and Content-Type header ?
Is the X-Content-Type-Options security header not present ?
Can the Content-Type header be edited, and the POST request still be submitted successfully ?
If the answer is yes to the questions above, then one should be able to perform Content-Type juggling and might find a way to perform other attacks as a result:
If one can switch to application/xml, should be tried.
If one can switch to application/zip, uploading malicious zip file should be tried.
If one can switch to application/php, uploading PHP payloads should be tried.
If one can switch to application/image, uploading should be tried.
One should not stick to this list and always try several Content-Type values.
In this context, an attacker can try to edit the charset (e.g. from utf-8 to utf-7) to bypass security controls such as Web Application Firewalls (WAFs), or regular expressions that check the value of a form. This technique cannot bypass the impact of the XCTO security header though (see the part).
By combining Content-Type juggling with another attack, it's possible to extract information from the target (more about it in ).
For more insight on this attack, refer to , by .
