5 ms·
FYI, Noscript had a serious zero-day which runs js files with MIME type text/css.
by howiroll 7y ago
FYI, Noscript had a serious zero-day which runs js files with MIME type text/css.
- zamadatix 7y ago"FYI", so what am I supposed to do with this information? If software were perfect we wouldn't need solutions like this in the first place.
- howiroll 7y agoThe software is to block scripts, duh. Imagine sudo giving root access to anyone. That’s how severe the vulnerability was. This means there is a severe problem with the dev cycle of this software.
- oliwarner 7y agoRuns? You mean doesn't block?
- howiroll 7y agoYeah. I was wrong but if mime was set as "text/html;/json" full JS pwnage was possible. https://gist.github.com/x0rz/8198e8e22b1f70fddb9c815c1232b795 https://gist.github.com/x0rz/8198e8e22b1f70fddb9c815c1232b79...