News for hackers. Stuff that matters.

A comment on A file that's both an acceptable HTML page and a JPEG (view source on it).

Re:A file that's both an acceptable HTML page and a JPEG (vi... by rescripting on Friday July 06, 2012 @03:04PM (#4209170)
Perhaps I don't know enough about how this works, but couldn't you use this to inject runnable javascript in to a page? If this is possible it's pretty scary as it would allow you to upload a hidden payload in to an otherwise innocent looking image.
[ Parent | on HN ]
Re:A file that's both an acceptable HTML page and a JPEG (vi... by subleq on Friday July 06, 2012 @03:28PM (#4209265)
Yes, certain versions of IE can be tricked into executing javascript in images: http://www.h-online.com/security/features/Risky-MIME-sniffin...
[ Parent | on HN ]
Re:A file that's both an acceptable HTML page and a JPEG (vi... by Tobu on Saturday July 07, 2012 @09:06AM (#4211538)
Indeed: https://code.google.com/p/browsersec/wiki/Part2#Survey_of_co...
[ Parent | on HN ]
Re:A file that's both an acceptable HTML page and a JPEG (vi... by WiseWeasel on Friday July 06, 2012 @03:28PM (#4209264)
I was able to add javascript code in there and it executed properly, but the browser won't parse the jpg as html unless I give it a .html filename extension. I don't see how this could be easily exploitable.
[ Parent | on HN ]
Re:A file that's both an acceptable HTML page and a JPEG (vi... by lindenr on Friday July 06, 2012 @04:10PM (#4209404)
Is it possible for the file extension to say one thing and the MIME type to say something else? So the file extension could be .jpg (reassuring the user that it is only an image) but the HTTP response says it is text/html?

I think a similar exploit was used recently with .svg images - they can contain javascript (being XML) which will be executed by the browser. Not sure about the details however.

[ Parent | on HN ]
Re:A file that's both an acceptable HTML page and a JPEG (vi... by luchs on Friday July 06, 2012 @04:35PM (#4209529)
>I think a similar exploit was used recently with .svg images - they can contain javascript (being XML) which will be executed by the browser. Not sure about the details however.

However, the JavaScript shouldn't execute if the image is embedded via <img>.

[ Parent | on HN ]
Re:A file that's both an acceptable HTML page and a JPEG (vi... by kpi on Friday July 06, 2012 @03:33PM (#4209283)
Interesting thought but browsers should not interpret javascript inside an image. I would expect image rendering to be separated. Can someone with an expertise in browser design tell us how this actually works?
[ Parent | on HN ]