bugtraq - WebWasher Classic - HTTP CONNECT weakness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 28 Jan 2005 13:46:35 +0100 (MET)
From: "Oliver Karow" <Oliver.Karow@....de>
To: bugtraq@...urityfocus.com
Subject: WebWasher Classic - HTTP CONNECT weakness

WebWasher Classic - HTTP CONNECT weakness
=========================================

WebWasher Classic
=================

WebWasher Classic is a well known HTTP-URL/Popup/Script filtering proxy
which 
is free for non commercial use.
WebWasher Classic supports two modes, a client mode, where it only works for
the local machine (bound to localhost) and a server mode, where it serves as
a network proxy (bound to 0.0.0.0).

Weakness
========

If running in server mode, it is possible to connect from remote to tcp
ports
listening on 127.0.0.1 of the WebWasher system. This is an design flaw,
because CONNECT requests to localhost should be denied. 
It also may be possible to bypass accesslists of firewalls, protecting the 
WebWasher system.

Version
=======

WebWasher Classic v3.3 and v.2.2.1 on Windows platform.
Other platforms were not tested, but may also be affected.

Exploiting/PoC
==============

1) Start a netcat listener on the WebWasher system:
        netcat -L -p 99 -s 127.0.0.1 < hallo.txt
2) Connect to the WebWasher proxy port (default 8080/tcp)
3) Enter command "CONNECT 127.0.0.1:99 HTTP/1.0"

As a result, content of hallo.txt will appear.

Vendor:
=======

http://www.webwasher.com
(Webwasher belongs to CyberGuard)

Discovered
==========
by oliver karow
http://www.oliverkarow.de/research/WebWasherCONNECT.txt

-- 
Sparen beginnt mit GMX DSL: http://www.gmx.net/de/go/dsl