full-disclosure - Re: Kevin Johnson BASE <= 1.3.6 authentication bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 6 Jun 2007 11:04:27 +0100
From: "Jamie Riden" <jamie.riden@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Kevin Johnson BASE <= 1.3.6 authentication
	bypass

On 04/06/07, Johnny Storm <johnny653@...il.com> wrote:
> Basic Analysis and Security Engine (BASE)
> (http://base.secureideas.net/)
>
>
> One more security product with lame bugs...
>
> Let's look at Kevin's authentication code,
> for example in base_main.php (all pages vulnerable):
>
>  [...]
>  64   // Check role out and redirect if needed -- Kevin
>   65   $roleneeded = 10000;
>   66   $BUser = new BaseUser();
>   67   //if (($Use_Auth_System == 1) && ($BUser->hasRole($roleneeded) == 0))
>  68   if ($Use_Auth_System == 1)
>  69   {
>   70       if ($BUser->hasRole($roleneeded) == 0)
>  71       {
>   72           header("Location: $BASE_urlpath/index.php");
>  73       }
>  74   }
>  [...]
>
> Where is bug?
> Yes, your browser will redirect after received location header,
> but what if not? ;-)

[carefully ignoring the rest of the thread...]

Yes, I believe it's good practice to exit(); after a header('Location:
...') - I've certainly tried to make all my code do it as far as
possible. See for example:

"Special attention should be paid when using Location header, however,
as it is used to redirect clients from one page to another. When you
send a Location header, PHP will continue to parse the script after
the header was issued, which wastes system resources and also may let
people see pages they would otherwise not be able to see. As a result,
it's best to use call "exit;" immediately after header("Location:
...") to make sure that nothing happens after the redirect notice has
been sent."  --
http://www.hudzilla.org/phpwiki/index.php?title=Sending_custom_HTTP_headers

That's all I'm saying, as I don't know the code well enough to guess
the security implications and I don't have a running system to test on
right now.

cheers,
 Jamie
-- 
Jamie Riden, CISSP / jamesr@...ope.com / jamie@...eynet.org.uk
UK Honeynet Project: http://www.ukhoneynet.org/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/