full-disclosure - Re: Joomla Content Manager 1.5 Mail Fun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 11 Jul 2011 13:26:02 +1200
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Joomla Content Manager 1.5 Mail Fun

Tomm Foo wrote:

> This might be old, but I find this interesting enough that Ill share just in
> case.

Dunno if this specific one is know, but spammers (especially 419'ers) 
have been abusing these poorly implemented "Email a friend" type 
functions on web pages for quite some time...

> By accident I ran across several sites that allow you to send an email
> containing a link to whatever site you please from any sender you choose,
> all under the header of a presumably legitimate site.
> 
> An example,
> 
> https://www.1stprioritymortgage.com/index.php?option=com_mailto&tmpl=component&link=aHR0cHM6Ly93d3cuMXN0cHJpb3JpdHltb3J0Z2FnZS5jb20vaW5kZXgucGhwP3ZpZXc9YXJ0aWNsZSZpZD04NCUzQXNpdGUtbWFwJm9wdGlvbj1jb21fY29udGVudCZJdGVtaWQ9OTM=
> 
> (found by clicking the mail button on all the article pages containing this
> software) will send the recipient you designate a link to the page you were
> viewing. However, by changing the base64 code above to a link of your own
> works as well, thus
> 
> https://www.1stprioritymortgage.com/index.php?option=com_mailto&tmpl=component&link=Cmh0dHA6Ly93d3cuZXZpbGdheXNleC5jb20vdmlydXMucGhwPz1sb2wK
> 
> will be sent to the recepient instead. Spoof a legitimate page and you could
> easily snag the cluesless plebe into visiting somewhere much more nasty.

Of course, that Base64-encoded string need not decode to a URL...

You can Base64 encode any message body you desire (length limits not 
tested) and stick that in as the link parameter to the URL.  The server-
side processor happily decodes that and adds that text to its own 
(quite brief in this case) message body.  As the sent messages are:

   Content-Type: text/plain

some of the cleverness that other such "Email a friend" forms have 
(quite unintentionally) allowed with HTML content are not available.

Oh, and there is an issue with "+" chars in the Base64-encoded text 
passed back to the form processor (they get turned into spaces and 
dropped, as you may expect).

A good thing this particular instance has that many others don't is 
that it tries to prevent multiple addresses being entered via the form, 
making it somewhat less spammer-friendly (though I've seen many 
instances where 419's apparently c'n'p the same stuff over and over 
into the same form, with a different Email address each time or maybe 
have automated it to do one address at a time).

Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/