What is MIME Sniffing? How to Protect Your Website from MIME "Guessing" Attacks


The Issue

As you may already know, alongside securing your website on the server side to ensure that no one can access it and perform unauthorized actions, client-side security is also crucial. Popular web browsers are constantly being updated with security patches and additional technical specifications to enhance their security. Every user wants a browser that offers maximum protection.

MIME types are one of the specifications that indicate the nature and format of a document, file, or byte classification. Here's a simple example to help you understand: if an API endpoint returns a response with the Content-Type: application/json attribute in the headers, the client immediately knows that the returned data is in JSON format and can handle it accordingly, instead of having to "guess" whether the data is text, image, or video.

If there is no Content-Type or in some browsers, they don't "like" to check the Content-Type, they will perform a "guessing" process to determine the format of the returned data. This inadvertently creates an attack called "MIME Sniffing."

What is MIME Sniffing?

MIME Sniffing is a technique used by some web browsers (mainly Internet Explorer) to check the content of a specific resource. This is done to determine the file format of the response content. This technique is useful in cases where there is not enough information, such as the Content-Type, for a specific content, thereby allowing the browser to interpret the content inaccurately.

Although MIME sniffing can be useful for determining the exact file format of the content, it can also pose security vulnerabilities. These vulnerabilities can be dangerous for both the website owner and the visitors. This is because an attacker can exploit the "guessing" capability of MIME sniffing to perform a Cross-Site Scripting (XSS) attack.

The process of MIME Sniffing is quite simple and involves the following main steps:

• The web browser requests a specific content response that either lacks a content type or has a previously set content type at the origin server.
• The web browser "sniffs" the content to analyze the specific file format of the content.
• Once the browser has completed the analysis, it compares what it found with what the web server provides in the Content-Type header (if present). If there is a mismatch, the browser will use the MIME type it determines to be associated with the content.

Let's say your website allows users to upload files to the server, and you only accept a specific image format like JPG. A clever attacker may change the file extension of an HTML file to .jpg and upload the file. When the browser performs MIME sniffing while trying to display the image, there is a high chance that the HTML code will be executed in the browser.

How to Prevent Browser MIME Sniffing

Most modern browsers respect this header, including Chrome/Chromium, Edge, IE >= 8.0, Firefox >= 50, and Safari >= 11.

To set this up, you simply need to include X-Content-Type-Options: nosniff in the HTTP response headers of your server.

For example, if you are using Nginx as the server:

server {
    listen 443 ssl;

    ...  

    add_header X-Content-Type-Options nosniff;
    ...  

Summary

Although this security mechanism may now be a default setting or a "must-have" configuration of web servers, I hope this article provides readers with a deeper understanding of the importance of technical specifications and potential exploitable behaviors that can be used for malicious purposes at any time.