1151340 - AMO should send X-Content-Type-Options: nosniff

Status: RESOLVED FIXED

(addons.mozilla.org :: Security, defect)

Description

[kaleemshaik786]

Attachment: screen shots.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20150402191859

Steps to reproduce:

Hi There is some issue in https://addons.mozilla.org/en-US/firefox/users/edit#user-profile
However I could not exploit it this issue.I was able to upload non png or jpg images in profile pictures section.

I believe application is only checking content type header in request based on that It is taking decision 
I bypassed the validation using double extension method.Able to upload files
eg: test.php.jpg
Application is treating this as jpg file and file is uploaded successfully. However I was not able to execute the content. This should be resolve

Pls see the screen shot

Comment 1

[Frederik Braun [:freddy]]

I'll take a look whether this is exploitable in a different context..

Comment 2

[Frederik Braun [:freddy]]

I couldn't find a way to exploit this in any way. I guess this is sec-low or sec-other: addons.mozilla.org should still send a nosniff header to IE users.

Comment 3

[Frederik Braun [:freddy]]

We should still consider sending the nosniff thing.

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Is this resolved with CSP, or is it a separate issue?

Comment 5

[Andy McKay]

Seperate.

Comment 6

[Firdoesh Ali]

Attachment: scrap.py

Comment 7

[Stuart Colville [:muffinresearch]]

This is already being done.