The download function of UC browser does not limit the same source to cause RFD attacks and Solutions

The download function of UC browser does not limit the same source to cause RFD attacks and Solutions

The download function of UC browser does not limit the same source to cause RFD attacks.

Open http://suggestion.baidu.com/su#/1.bat; in browser mode ;? Wd = & cb = calc | & sid = 1440_2031_1945_1788 & t = 1362056239875 then the download page is displayed. Next, download and open the file and execute this directly. For details, you still need to refer to it.
 

 

Solution:

In this way, the cause of the vulnerability is very concise, and the following conditions must be met: 1. in the return, we can see our input, and the content-type is not a common type, json or jsonp, and so on... 2. the url is not filtered or escaped '/'';' 3. Download type. Use incomplete Content-Disposition: attachment or content-type that does not comply with the http protocol. This is basically the case in principle. As for exploitation, this is indeed a weakness!