full-disclosure - CERT: Vulnerability in web redirectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3E7CAB9C.4010800@guninski.com>
From: guninski at guninski.com (Georgi Guninski)
Subject: CERT: Vulnerability in web redirectors

Like this one?:
--------------------
http://srd.yahoo.com/S=2766679:WS1/R=1/K=microsoft+sux/H=0/T=1048357500/F=131cc5f493bf26b0a115b6debc24d362/*http://www.cryptome.org
--------------------
(may be wrapped)

Georgi

Kurt Seifried wrote:
> Like hack4life stated this is a pretty well known problem. Solving it isn't
> to hard. Legitimate clients will send an HTTP referer, thus for some
> unsuspecting user who clicks on a redirect link in an email they will send a
> blank referer, or off a website that referer. So simply add some logic in
> your script to check the referer, a quick and dirty in php for example (yes,
> this code is horrible and ugly, but it's a reasonably clear example):
> 
> <HTML>
> <HEAD>
> <TITLE>You are now leaving example.org</TITLE>
> <?php
> if (preg_match ("/example\.org\//i", $_SERVER["HTTP_REFERER"] )) {
> 
>   print "<META http-equiv=\"refresh\" content=\"1;URL=";
>   echo $_SERVER["QUERY_STRING"];
>   print "\">";
>   print "</HEAD>";
>   print "<BODY bgcolor=\"#ffffff\">";
>   print "<P>[1] Redirecting you to:";
>   print "<A HREF=\"";
>   echo $_SERVER["QUERY_STRING"];
>   print "\">";
>   echo $_SERVER["QUERY_STRING"];
>   print "</A>, if it doesn't work click on the link.</P>";
>   print "<P>";
>   echo $_SERVER["HTTP_REFERER"];
>   print "</P>";
> } else {
>   print "</HEAD>";
>   print "<BODY bgcolor=\"#ffffff\">";
>   print "<P>Someone has tried to use this site's web redirector in an
> attempt to make a link appear legitimate.</P>";
> }
> ?>
> 
> Obviously this is not bullet proof, anyone who hacks their client to send
> fake referer's can get around it, but then we aren't trying to block that
> kind of person, we're simply trying to prevent widespread abuse by a
> spammer/etc.
> 
> 
> Kurt Seifried, kurt@...fried.org
> A15B BEE5 B391 B9AD B0EF
> AEB0 AD63 0B4E AD56 E574
> http://seifried.org/security/
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
>