Description
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
References
- MS08-031 vendor-advisory
- http://www.mindedsecurity.com/MSA02240108.html
- 29453 third-party-advisory
- oval:org.mitre.oval:def:5291 vdb-entry signature
- ADV-2008-1778 vdb-entry
- 1020226 vdb-entry
- TA08-162B third-party-advisory
- HPSBST02344 vendor-advisory
- 28379 vdb-entry
- 20080321 [MSA02240108] IE7 allows overwriting of several headers leading to Http request Splitting and smuggling. mailing-list
- ADV-2008-0980 vdb-entry
- 3785 third-party-advisory