bugtraq - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3FD6FF22.15093.9A3B9984@localhost>
Date: Wed, 10 Dec 2003 11:10:26 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: Internet Explorer URL parsing vulnerability

<bugtraq@...thedingbat.com> wrote:

> By opening a window using the http://user@...ain nomenclature an
> attacker can hide the real location of the page by including a 0x01
> character after the "@" character.  ...

"before" methinks (as in your example!).

> ...  Internet Explorer doesn't display the
> rest of the URL making the page appear to be at a different domain. 
> 
> # POC ##########
> http://www.zapthedingbat.com/security/ex01/vun1.htm

In fact, it seems that the URL-encoding is unnecessary (although how 
reliably a page with an 0x01 character in it will be transported around 
I'm not sure and it would likely be less useful for attempted exploits 
transmitted via Email).  So, anyone busily setting up further filters 
in any sanitizing procedures for incoming HTML should not only be 
looking for "%01" but straight 0x01 characters (although reliably 
interpreting this when combined with scripting -- see below -- might be 
a headache).

Oddly (or not, depending on your experience with, and expectations of, 
inconsistencies in MS products) this does not seem to work in a 
straight http-equiv=refresh situation.  Odder yet (or not, depending on 
your experience with, and expectations of, inconsistencies in MS 
products) it does work with http-equiv=refresh if you script the 
writing of the refresh statement.  Go figure!

I don't have ready access to a suitable server config at the moment to 
try the variations with server-side redirects -- anyone??

Regards,

Nick FitzGerald