Server Side Detection of Content Sniffing Attacks

Content sniffing attacks occur if browsers render non-HTML files embedded with malicious HTML contents or JavaScript code as HTML files. The rendering of these embedded contents might cause unwanted effects such as the stealing of sensitive information through the execution of malicious JavaScript code. The primary source of these attacks can be stopped if the uploading of malicious files can be prevented from the server side. However, existing server side content sniffing attack detection approaches suffer from a number of limitations. First, file contents are checked only to a fixed amount of initial bytes whereas attack payloads might reside anywhere in the file. Second, these approaches do not provide any mechanism to assess the malicious impact of the embedded contents on browsers. This paper addresses these issues by developing a server side content sniffing attack detection mechanism based on content analysis using HTML and JavaScript parsers and simulation of browser behavior via mock download testing. We have implemented our approach in a tool that can be integrated in web applications written in various languages. In addition, we have developed a benchmark suite for the evaluation purpose that contains both benign and malicious files. We have evaluated our approach on three real world PHP programs suffering from content sniffing vulnerabilities. The evaluation results indicate that our approach can secure programs against content sniffing attacks by successfully preventing the uploading of malicious files.