MIME Spoofing: Executable Disguised as PDF
An executable file (.exe) with its Content-Type header set to application/pdf, tricking browsers and email clients into treating it as a safe document.
How This Attack Works
MIME spoofing occurs when a file's declared Content-Type doesn't match its actual content. Attackers rename malicious executables with innocent extensions or serve them with misleading MIME types. If the receiving application trusts the MIME type without verifying magic bytes, it may execute or open the file unsafely.
Attack Vector
Email attachment with .pdf extension but executable content. Web download served with Content-Type: application/pdf but containing PE executable bytes.
Real-World Example
The Emotet trojan frequently used MIME-spoofed Office documents delivered via email. Attackers sent .doc files that were actually macro-enabled .docm files with malicious payloads.
Vulnerable Code
// UNSAFE: Trusting the file extension
const isPDF = file.name.endsWith('.pdf');
if (isPDF) {
// Dangerous! File could be anything
openDocument(file);
}Safe Implementation
// SAFE: Verify magic bytes
const buffer = await file.slice(0, 4).arrayBuffer();
const bytes = new Uint8Array(buffer);
const isPDF = bytes[0] === 0x25 && bytes[1] === 0x50
&& bytes[2] === 0x44 && bytes[3] === 0x46; // %PDF
if (isPDF) {
openDocument(file);
} else {
reject("File content doesn't match PDF format");
}Safe Handling Guidelines
Always verify file content by checking magic bytes, not just the extension or MIME type. Use libraries like file-type (Node.js) or python-magic to detect actual content. Reject files where declared type doesn't match detected type.