logoalt Hacker News

SethMLarsonyesterday at 9:45 PM1 replyview on HN

Author here, that's a good idea. A straightforward way to exploit an implementation differential like this is if you have a software system that contains two different implementations of IDNA 2003 processing user input. One part of the process processes the domain correctly, the other incorrectly, and in this case you can have one part of a system (such as a policy/filter) "see" the data one way and the other part of the system (such as, taking an action as a result of the data) see the data in another way.

Server-side Request Forgery (SSRF) is an example of such an exploit targeting a differential in implementations of URL parsers, which is similar to this implementation difference.


Replies

AgentOrange1234yesterday at 10:03 PM

"if you have a software system that contains two different implementations of IDNA 2003 processing user input"

Is that a real thing though? Is someone doing that?

show 4 replies