bugtraq - Ghost users in Chat Anywhere 2.72

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 9 Mar 2004 12:11:54 +0000
From: Luigi Auriemma <aluigi@...ervista.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com
Subject: Ghost users in Chat Anywhere 2.72



#######################################################################

                             Luigi Auriemma

Application:  Chat Anywhere
              http://www.lionmax.com/chatanywhere.htm
Versions:     <= 2.72
Platforms:    Windows
Bug:          users cannot be banned or kicked
Risk:         low
Exploitation: remote, via browser
Date:         09 Mar 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Chat Anywhere is a web chat server allowing multiple chat rooms
accessible via browser. It supports also remote administration via web.


#######################################################################

======
2) Bug
======


Using %00 before the nickname the user is able to hide himself to the
administrator.
Practically the admin cannot see the user's IP address in the
administration web page because it is substituited by the text $IP$.
This problem avoids the banning and the kicking of the user so the
admin has no control over him.


#######################################################################

===========
3) The Code
===========


I have created a simple html file that sends %00 in plain-text because
almost all the browsers sends it encoded as %2500:

  http://aluigi.altervista.org/poc/ca-ghost.htm


#######################################################################

======
4) Fix
======


Version 2.72a


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org