Malformed media type

firetail:malformed-media-type

Type:

Observation

Rule Severity:

Medium

Media type name is malformed.

A malformed media type name typically indicates an error in specifying the format of a MIME type (Multipurpose Internet Mail Extensions type), such as type/subtype, used to identify content types in web communication. Common issues include syntax errors, unsupported or improperly encoded media types, and discrepancies between specified types and system requirements or API expectations. Resolving such errors often involves verifying the correct format, ensuring compatibility with system or API specifications, and addressing any encoding or configuration issues affecting media type interpretation.

Remediation

Use the correct IANA registered format for MIME types.

Example Attack Scenario

Content Sniffing Vulnerability: Browsers sometimes perform content sniffing (also known as MIME sniffing) to determine the type of content if the MIME type is not explicitly specified or if it is malformed. If a malicious user can control or manipulate the malformed MIME type in such a way that it tricks the browser into interpreting it as a different, potentially dangerous type (like executing JavaScript in what is supposed to be a plain text file), it could lead to cross-site scripting (XSS) attacks.

How to Identify with Example Scenario

How to Resolve with Example Scenario

How to Identify with Example Scenario

Find the text in bold to identify issues such as these in API specifications

How to Resolve with Example Scenario

Modify the text in bold to resolve issues such as these in API specifications
References:

More findings

All Findings