{
  "id": "security/xss-via-malicious-file-upload-with-content-disposition-bypass",
  "signature": "XSS via malicious file upload with Content-Disposition bypass",
  "signature_zh": "通过Content-Disposition绕过恶意文件上传导致的XSS",
  "regex": "XSS via malicious file upload with Content-Disposition bypass",
  "domain": "security",
  "category": "resource_error",
  "subcategory": null,
  "root_cause": "When a file upload endpoint returns user-supplied filenames in the Content-Disposition header without proper sanitization, an attacker can inject script code that executes in the browser when the file is downloaded.",
  "root_cause_type": "generic",
  "root_cause_zh": "当文件上传端点在Content-Disposition头中返回用户提供的文件名而未进行适当清理时，攻击者可以注入脚本代码，在下载文件时在浏览器中执行。",
  "versions": [
    {
      "version": "Apache Tomcat 9.0.70",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Spring Boot 2.7.10",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Nginx 1.24.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "IIS 10.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Sanitizing the filename by removing only script tags is insufficient because attackers can use event handlers like onerror or encode characters to bypass filters.",
      "fail_rate": 0.65,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Setting Content-Type to application/octet-stream does not prevent XSS if the browser sniffs the content type or if the filename contains script that executes on download.",
      "fail_rate": 0.55,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Using a whitelist of allowed extensions is bypassed if the filename contains script in the parameter string (e.g., file.html?script=alert(1)).",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Sanitize the filename by stripping all non-alphanumeric characters except dots and hyphens. Example in Python: import re; safe_filename = re.sub(r'[^a-zA-Z0-9._-]', '', original_filename). Then set Content-Disposition to attachment; filename=\"safe_filename\" and ensure Content-Type is correct.",
      "success_rate": 0.9,
      "how": "Sanitize the filename by stripping all non-alphanumeric characters except dots and hyphens. Example in Python: import re; safe_filename = re.sub(r'[^a-zA-Z0-9._-]', '', original_filename). Then set Content-Disposition to attachment; filename=\"safe_filename\" and ensure Content-Type is correct.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a random UUID as the filename on the server and store the original filename in a database, never returning it in headers. Example: response.setHeader('Content-Disposition', 'attachment; filename=\"' + uuid + '\"');",
      "success_rate": 0.95,
      "how": "Use a random UUID as the filename on the server and store the original filename in a database, never returning it in headers. Example: response.setHeader('Content-Disposition', 'attachment; filename=\"' + uuid + '\"');",
      "condition": "",
      "sources": []
    },
    {
      "action": "Add Content-Security-Policy header with 'sandbox' directive for file download endpoints to prevent script execution.",
      "success_rate": 0.85,
      "how": "Add Content-Security-Policy header with 'sandbox' directive for file download endpoints to prevent script execution.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Sanitize the filename by stripping all non-alphanumeric characters except dots and hyphens. Example in Python: import re; safe_filename = re.sub(r'[^a-zA-Z0-9._-]', '', original_filename). Then set Content-Disposition to attachment; filename=\"safe_filename\" and ensure Content-Type is correct.",
    "Use a random UUID as the filename on the server and store the original filename in a database, never returning it in headers. Example: response.setHeader('Content-Disposition', 'attachment; filename=\"' + uuid + '\"');",
    "Add Content-Security-Policy header with 'sandbox' directive for file download endpoints to prevent script execution."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://owasp.org/www-community/attacks/xss/",
  "official_doc_section": null,
  "error_code": "XSS_FILE_UPLOAD_CONTENT_DISPOSITION",
  "verification_tier": "ai_generated",
  "confidence": 0.82,
  "fix_success_rate": 0.88,
  "resolvable": "true",
  "first_seen": "2024-01-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}