HTML Form Protocol Attack

Type securityvulns
Reporter Securityvulns
Modified 2001-08-16T00:00:00


Some HTML browsers can be tricked through the use of HTML forms into sending more or less arbitrary data to any TCP port. This can be used to send commands to servers using ASCII based protocols like SMTP, NNTP, POP3, IMAP, IRC, and probably others. By sending HTML email to unsuspecting users or using a trojan HTML page, an attacker might be able to send mail or post Usenet News through servers normally not accessible to him. In special cases an attacker might be able to do other harm, e.g. deleting mail from a POP3 mailbox.

In most situations this attack would not be considered a big problem, but it is an interesting example on how the combination of several innocuous and seemingly totally unrelated protocol features can be used to mount an attack.

A paper describing this "HTML Form Protocol Attack" is available at

The Postscript version is attached to this mail.