Message-ID: <924f292805022819142aaf2da8@mail.gmail.com>
Date: Mon, 28 Feb 2005 22:14:51 -0500
From: Jason Frisvold <xenophage0@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: BizMail 2.1 Spam Exploit


On Fri, 18 Feb 2005 08:48:11 -0500, Jason Frisvold <xenophage0@...il.com> wrote:
> Greetings all,
> 
> This form allowed a hacker to directly call the cgi, forge a referer
> url, and, with carefully crafted data, send spam emails without
> notifying the admin of the site.  Below is the email I sent to the
> author of Bizmail.  He was intially skeptical, but worked with me and
> has released a new version, 2.2, which fixes this exploit.

After further study, the 2.2 release does not sufficiently fix the
problem.  The spammer can still exploit the cgi and send spam, but the
email address set as the first sendto address is also sent a copy.

A patch to fix this problem is below.  I cannot guarantee this will
work for every situation, but it seems to be doing the trick for me..

--- bizmail.cgi 2005-02-17 20:10:26.000000000 -0500
+++ bizmail.cgi 2005-02-27 13:47:29.000000000 -0500
@@ -534,41 +534,28 @@
     @required_stealth = split(/,/,$formdata{'required_stealth'});

 for ($indexreq = 0; $indexreq < @required; $indexreq++) {
-$myrequired = $required[$indexreq];
-$myformreq = $formdata{"$myrequired"};
+   $myrequired = $required[$indexreq];
+   $myformreq = $formdata{"$myrequired"};

+   if (!$myformreq){

-  if (!$myformreq){
-
-if ($use_html_error eq "1") {
-      require 'required.cgi';
-      &REQ_format_error;
-}else{
-      require 'error.cgi';
-      &format_error;
-}
-
-  } ## END missing REQUIRED ##
-  elsif ($myrequired eq "email"){
-      if (!$myformreq || $myformreq =~
/(@.*@)|(\.\.)|(@\.)|(\.@)|(^\.)/ || $myformreq !~
/^.+\@(\[?)[a-zA-Z0-9\-\.]+\.([a-zA-Z0-9]+)(\]?)$/){
-
-               if ($use_html_error eq "1") {
-                     require 'required.cgi';
-                     &REQ_format_error;
-               }else{
-                    require 'error.cgi';
-                     &missing_email;
-               }
+      if ($use_html_error eq "1") {
+         require 'required.cgi';
+         &REQ_format_error;
+      }else{
+         require 'error.cgi';
+         &format_error;
       }
-  } ## END IF REQUIRED IS EMAIL ##
-
-

+   }

+} # End required loop

+if ($formdata{'email'} && ($formdata{'email'} =~
/(@.*@)|(\.\.)|(@\.)|(\.@)|(^\.)/ || $formdata{'email'} !~
/^.+\@(\[?)[a-zA-Z0-9\-\.]+\.([a-zA-Z0-9]+)(\]?)$/)) {
+       require 'error.cgi';
+       &missing_email;
 }

-
 if ($formdata{'sendreply'} eq "1"){
       if (!$formdata{'email'} || $formdata{'email'} =~
/(@.*@)|(\.\.)|(@\.)|(\.@)|(^\.)/ || $formdata{'email'} !~
/^.+\@(\[?)[a-zA-Z0-9\-\.]+\.([a-zA-Z0-9]+)(\]?)$/){



> ----
> 
> After setting up additional logging and notifications, I was finally
> able to determine how this exploit works.
> 
> Through reading the code and some general experimentation I was able
> to determine that the only required argument for the script is the
> email argument.  A simple multi-line message, beginning with a
> newline, can be used to re-write the email headers and send spam to
> any destination, regardless of the hard-coded send_to addresses.
> 
> Because none of the other optional variables are set, no response
> messages are sent.  The only hint that someone has abused the script
> is information entered into the datafile, if the datafile is enabled.
> 
> I had enabled the okurls feature as well.  This feature ensures that
> the referer url matches a list of allowed referer urls.
> Unfortunately, the referer is not something that can be trusted, as
> this is sent by the browser.  So, this is very easily fooled.  In
> fact, the individual(s) that were abusing the script on our system
> reported a User-Agent of "Microsoft URL Control - 6.00.8169", which
> appears to be some sort of COM/OLE control which can be programmed to
> send a specific referer address.
> 
> Without the need for programming your own COM/OLE control, there is a
> simple way to test this out.  Place the following into an HTML file :
> 
> <HTML>
> <HEAD> <TITLE>Exploit Test Page</TITLE> </HEAD>
> <BODY>
> <form action="http://www.example.com/cgi-bin/bizmail/bizmail.cgi"
> method="POST" name="Subscribe">
> <TEXTAREA rows="5" name="email"></TEXTAREA>
> <INPUT TYPE="submit" VALUE="Submit" class="submit">
> </FORM> </BODY> </HTML>
> 
> In the textbox that pops up, enter in the following (begin by hitting
> enter to insert a blank line)
> 
> From:joeblow@...mple.com
> To:yourvalidemail@...rdomain.com
> Subject:Exploit Test
> 
> This is a test
> 
> Click submit.  You'll receive an email from the bizmail script, but
> you won't receive the normal contact email.  You can check the .dat
> file and see a copy of what you sent.
> 
> I believe there's a simple fix for this.  The variable,
> $formdata{'email'}, should be checked for invalid characters, such as
> carriage returns and line feeds.  In addition, neither the smtp nor
> sendmail module should be called if the $MAIN_mail_send variable is
> not set.  A subject should probably be required as well.
> 
> As per the suggested guidelines of the securityfocus bugtraq list, I
> would like to hear back from you within one week.  In the interest of
> security, I will be posting details of this exploit to the bugtraq
> list after one week if I have not heard back from you.
> 
> --
> Jason 'XenoPhage' Frisvold
> XenoPhage0@...il.com
> 


-- 
Jason 'XenoPhage' Frisvold
XenoPhage0@...il.com

Powered by blists - more mailing lists