bugtraq - LiteSpeed Web Server - Security Advisory - HTTP Header Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 20 Jan 2016 14:52:56 +0200
From: Onur Yilmaz <onur@...sparker.com>
To: fulldisclosure@...lists.org, cert@...t.org, vuln@...unia.com,
  bugs@...uritytracker.com, submissions@...ketstormsecurity.org,
  bugtraq@...urityfocus.com
Subject: LiteSpeed Web Server - Security Advisory - HTTP Header Injection Vulnerability

Information
--------------------
Advisory by Netsparker
Name: HTTP Header Injection in LiteSpeed Web Server
Affected Software : LiteSpeed Web Server
Affected Versions: v5.1.0 and possibly below
Vendor Homepage : https://www.litespeedtech.com/
Vulnerability Type : HTTP Header Injection
Severity : Medium
Status : Fixed
CVE-ID : TBA
Netsparker Advisory Reference : NS-16-001

Description
--------------------
While testing Netsparker, we spotted an HTTP Header Injection
vulnerability in LiteSpeed.

LiteSpeed Web Server v5.1.0 and possibly below are affected if
mod_userdir is enabled. This vulnerability can be exploited in various
ways depending on the application.

Technical Details
--------------------
Proof of Concept URL for HTTP Header Injection in LiteSpeed Web Server:

/~%0d%0aSet-Cookie:Scanner=Netsparker%0d%0a

Advisory Timeline
--------------------
15 Jan 2016 - First Contact
18 Jan 2016 - Vendor Fixed
20 Jan 2016 - Advisory Released

Solution
--------------------
Patch released by LiteSpeed and annocunced here:
https://www.litespeedtech.com/products/litespeed-web-server/release-log.
Download the latest version.

Credits & Authors
--------------------
This issue has been discovered by Ziyahan Albeniz  while testing
Netsparker Web Application Security Scanner
(https://www.netsparker.com).

About Netsparker
--------------------
Netsparker web application security scanners find and report security
flaws and vulnerabilities such as SQL Injection and Cross-site
Scripting (XSS) in all websites and web applications, regardless of
the platform and technology they are built on. Netsparker scanning
engine’s unique detection and exploitation techniques allow it to be
dead accurate in reporting vulnerabilities, hence it does not report
any false positives. The Netsparker web application security scanner
is available in two editions; Netsparker Desktop and Netsparker Cloud.
Visit our website https://www.netsparker.com for more information.

Onur Yılmaz - National General Manager

Netsparker Web Application Security Scanner
T: +90 (0)554 873 0482