What Is a GIFAR Attack and How Does It Work?

A GIFAR attack is a security exploit that combines a valid Graphic Interchange Format (GIF) image and an executable Java Archive (JAR) into a single, dual-format file known as a polyglot. By exploiting differences in how image parsers and archive extractors read file structures, an attacker can bypass content-based file upload filters on a web server. This article explains the mechanics of a GIFAR attack, how the two conflicting file formats are merged into one functional file, and how attackers historically leveraged this technique to compromise web applications.

The Anatomy of a Polyglot File

A polyglot is a file that is simultaneously valid in two or more distinct file formats. The GIFAR attack, first demonstrated by security researchers in 2008, creates a polyglot file that is both an image and a program. Because the file satisfies the format specifications for both types, a web browser or server can interpret it as a harmless picture, while the Java Runtime Environment (JRE) can execute it as an application.

How GIF and JAR Formats Combine

The GIFAR attack works because the GIF and ZIP/JAR specifications parse data from completely different locations within a file:

  1. GIF Files Read from the Top Down: A valid GIF file begins with a fixed header (GIF87a or GIF89a) at byte zero, followed by screen descriptors, color tables, image data, and a terminating trailer byte (0x3B). Most image decoders process the file sequentially from the beginning and stop reading once they hit the trailer byte, ignoring any arbitrary data appended after it.

  2. JAR (ZIP) Files Read from the Bottom Up: A JAR file is structurally a ZIP archive. The ZIP standard does not require the archive headers to start at byte zero. Instead, the parser seeks the "End of Central Directory" (EOCD) record located near the very end of the file. The parser then uses the offsets defined in this directory to locate the archived files, ignoring any arbitrary data prepended before the archive entries.

To create a GIFAR, an attacker takes a valid GIF image and appends a compiled JAR archive directly to the end of it (often using a basic concatenation command like copy /b image.gif + applet.jar gifar.gif).

When processed by an image viewer, the parser reads the header, renders the image, and terminates at the GIF trailer, safely ignoring the appended JAR payload. Conversely, when the JRE loads the same file, it scans backward from the end, locates the ZIP Central Directory, and extracts or executes the Java classes while ignoring the preceding GIF image data.

Exploitation Scenario

The primary utility of a GIFAR attack was bypassing file upload restrictions to achieve Cross-Site Scripting (XSS) or violate the Same-Origin Policy (SOP).

  1. Upload Bypass: A target website allows users to upload profile pictures but restricts uploads strictly to image formats by checking magic bytes and file extensions. The GIFAR passes validation because it contains valid GIF magic bytes and renders cleanly as an image.
  2. Context Execution: Once the file is hosted on the target domain, the attacker points an HTML <applet> or <object> tag to the URL of the uploaded image.
  3. Privilege Escalation: Because the browser's Java plugin fetched the applet from the target domain, the code ran under the security context of that domain. This allowed the applet to read sensitive session cookies, access DOM elements, or perform authenticated requests on behalf of the victim.

Defense and Modern Context

Mitigating GIFAR and similar polyglot attacks requires servers to treat user-submitted media actively rather than passively storing raw bytes: