Reflected File Download
ID |
kotlin.reflected_file_download |
Severity |
high |
Resource |
Injection |
Language |
Kotlin |
Tags |
CWE:79, NIST.SP.800-53, OWASP:2021:A3, PCI-DSS:6.5.1 |
Description
Improper neutralization of external input that leads to reflected file download ('RFD').
Rationale
Reflected file download vulnerabilities (a variation of cross-site scripting classified under CWE-79) occur when user input is reflected in the contents or headers of a downloadable file without proper sanitization.
Attackers can exploit this to inject malicious scripts or content, tricking users into downloading and executing harmful files. This can occur when a web application reflects unsanitized user input back in the HTTP response, particularly in content-disposition or content-type headers involved in file downloads.
Consider the following Kotlin servlet example, which demonstrates a potential vulnerability:
import javax.servlet.ServletException
import javax.servlet.http.HttpServlet
import javax.servlet.http.HttpServletRequest
import javax.servlet.http.HttpServletResponse
import java.io.IOException
class FileDownloadServlet : HttpServlet() {
@Throws(ServletException::class, IOException::class)
override fun doGet(request: HttpServletRequest, response: HttpServletResponse) {
val filename = request.getParameter("filename")
// Potential vulnerability: reflecting user input in headers
response.setHeader("Content-Disposition", "attachment; filename=\"$filename\"")
// Assume file content is being processed and sent as a response
response.writer.println("File content of: $filename")
}
}In the example above, the filename is taken directly from user input and used in the content-disposition header, making this setup susceptible to reflected file download attacks if the input is not properly sanitized.
Remediation
To remediate reflected file download vulnerabilities, consider the following strategies:
-
Validate and Sanitize User Input: Always validate and sanitize user inputs before using them in HTTP headers or anywhere in the response. Implement whitelist validation strategies to limit inputs to allowed patterns or values.
-
Encode Output Appropriately: Use appropriate output encoding for HTTP headers (like URL encoding) to ensure that no executable scripts are injected in the header values.
-
Use Strong Content-Type and Content-Disposition Directives: When dynamically setting these headers, ensure that the content is aligned explicitly with the expected content type and that potentially dangerous content is not executed.
-
Perform Regular Security Testing: Employ comprehensive security testing, including static and dynamic analysis, to detect potential vulnerabilities and ensure that all input and output handling follows best practices.