full-disclosure - CERT: Vulnerability in web redirectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030322211916.GA26104@sirius.otherwize.co.uk>
From: dgl at dgl.cx (David Leadbeater)
Subject: CERT: Vulnerability in web redirectors

Georgi Guninski wrote:
> Like this one?:
> --------------------
> http://srd.yahoo.com/S=2766679:WS1/R=1/K=microsoft+sux/H=0/T=1048357500/F=131cc5f493bf26b0a115b6debc24d362/*http://www.cryptome.org
> --------------------
> (may be wrapped)

That site also demonstrates another issue with this type of HTTP Redirector
that has been mentioned as a security risk before:
http://srd.yahoo.com/S=2766679:WS1/R=1/K=microsoft+sux/H=0/T=1048357500/F=131cc5f493bf26b0a115b6debc24d362/*http://www.cryptome.org%0D%0ASet-cookie:%20foo%3D123%3B%%20domain%3D.yahoo.com%3B%20path%3D/

It adds a cookie for the whole .yahoo.com domain, this could be an attack
vector for other XSS (I wouldn't be surprised if there is less checking
done on cookie input) or session poisoning type attacks.