Overview

Client rendering, especially by browsers, relies heavily on the Content-Type of HTTP response headers. For example, if the HTTP response header is Content-Type: text/html, the browser interprets it as html.

Is the Content-Type specified in the HTTP response header really reliable? Certainly, the Content-Type predetermined by the server is sent to the browser in a conventional file upload, so there appears to be no problem in trusting it. Therefore, there have been many implementations in which clients, mainly browsers, unconditionally trust the Content-Type.

However, S3 and other S3-compatible object storage is now being used, and by requesting arbitrary Content-Types as metadata to such object storage, the Content-Type of the HTTP response header can be manipulated freely. In other words, a new attack path to the client has arisen.

Therefore, this presentation will introduce the scenarios caused by clients' unconditional trust in Content-Type and the results of a survey of bug bounty platforms and OSS.
A typical vulnerability caused by unconditional trust in Content-Type is XSS. An attacker sends Content-Type metadata to object storage that the browser can interpret as HTML.

For a study of Content-Types that browsers can interpret as HTML, see the following slides.
- XSS using dirty Content-Type in the cloud era
For example, suppose you have an implementation that allows uploads only if the Content-Type value matches the regular expression /\Aimage/(png|jpeg|jpg)/. This implementation can be prevented if the Content-Type is text/html or text/html;image/png, but not if it is image/png,text/html. An image/png,text/html is interpreted as text/html by major browsers such as Chrome and firefox. Two specific CVEs are as follows.
- Content-Type allowlist bypass vulnerability, possibly leading to XSS
- Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Bypass can also be done for weak string validation during object storage uploads.
For example
Prefix match startsWith: image/png,text/html
Suffix match endsWith: text/html;image/png
Partial match includes: text/html;image/png

Presentation Flow

• Self-introduction 1 min.
• What is Content-Type 1 min.
• Previous research 1 min.
• Browser interpretation 3 min.
• Traditional file upload 3 min.
• Object storage 1 min.
• File Uploading in the Cloud Era 3 mins.
• Weak validation bypass patterns 2 min.
• Validation results with bug bounty 3 mins.
• Validation results in OSS 3 min.
• Countermeasures 2 mins.
• Summary 2 mins.

Total 25 minutes

Strengths of this presentation

The strengths of this presentation are the following four points
1. the presenter is familiar with cloud security and security of cloud-based applications
2. appropriate for the cloud-native and cloud-first era
3. the discovery of a new attack path against browsers
4. discovery of Content-Type interpretation in browsers

1. the presenter is familiar with cloud security and security of cloud-based applications
   We, the proposers of this presentation, are proud to say that we are usually familiar with cloud security and applications built and implemented using cloud computing.
   In the past, we have presented anti-patterns for serverless applications at AWS Dev Day in Japan and have given talks to security engineers and developers on application security and threats targeting cloud environments using the latest technology stack.
   - AWS Dev Day 2023 E-2: Security by Design with Amazon S3, Amazon Cognito, and AWS Lambda Anti-Patterns
   - Introduction to Modern Web Security by Reading and Understanding Context
   - How to face threats specific to public clouds

2. appropriate for the cloud-native, cloud-first era
   The theme of this talk is how to design and implement applications built on the cloud to reduce security risks from attacks that exploit Object Storage metadata specifications. Among them, cloud-native or cloud-first environments that deal with volatile environments such as containers, auto-scale infrastructure, and FaaS, store and deliver files in Object Storage instead of delivering files from the server's disk storage. Since this is an important service and a major implementation that supports the idea of cloud-native and cloud-first, we believe that presenting at BSides LV will be fruitful for the attendees.

3. the discovery of a new attack path against browsers
   Changing the Content-Type of an HTTP response was difficult with traditional file uploads. However, we have discovered a new route of attack via object storage metadata. This is a novelty not found in other presentations.
   - File Upload Security in Object Storage - Rethinking “Malicious Data Writing” in the Cloud Era

4. the discovery of the browser's Content-Type interpretation
   Traditionally, there has been research on predefined Content-Types that are interpreted as HTML, but how browsers interpret arbitrary Content-Types has not been studied. This is another novelty not found in other presentations.
   - XSS via S3! New Perspective on Attack Methods Using Mysterious Content-Type Values