Reflected File Download
Summary#
Invicti detected a possible reflected file download which might enable attackers to gain complete control over a website user's machine by virtually downloading a file from a trusted domain.
This is a vulnerability in the browsers that only affects Microsoft Windows systems.
Impact#
An attacker can craft a URL on the target website that can execute commands on the website visitor's computer if the visitor accepts the download.
For a Reflected File Download attack to be successful:
- Attacker controlled input needs to be reflected in the response.
- Attacker should be able to change the URL of the vulnerable site to an executable file extension resulting a file download on the website user's browser.
Remediation#
- Add
Content-Dispositionheader withfilenameattribute in the HTTP response:Content-Disposition: attachment; filename=f.txt
Classifications#
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Tags
Related Vulnerabilities
