Description
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
References
- 20081106 countermeasure against attacks through HTML shared files mailing-list
- sharepoint-htmldocument-xss(46590) vdb-entry
- 20081106 Re: [WEB SECURITY] countermeasure against attacks through HTML shared files mailing-list
- http://www.pomcor.com/whitepapers/file_sharing_security.pdf
- 20081106 Re: [WEB SECURITY] countermeasure against attacks through HTML shared files mailing-list