All your header are belong to us
Summary: PortSwigger Research describes Alex's technique for spoofing browser HTTP headers: a Flash object can send a header with a non-standard name, and because languages such as PHP, Perl, Ruby and ColdFusion map underscores to hyphens when reading headers, the application processes the attacker's value instead of the browser's built-in header. The earlier Flash fix blocked spoofing of headers like Referer and User-Agent, but not this variant, which still enables reflected XSS on pages that echo received headers, as diagnostic error messages often do.
Bottom line: The post's working assumption is that a malicious site can spoof any request header of a user who visits it, so any application that trusts request headers for defenses such as XSRF and DNS pinning protection is relying on a control an attacker may already be able to bypass.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026