full-disclosure - Re: Apache/PHP REQUEST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bbf74ecc0704241003n3aaac561n12b58bd950905639@mail.gmail.com>
Date: Tue, 24 Apr 2007 20:03:38 +0300
From: "عبد الله احمد عنان" <enan2700@...il.com>
To: n3td3v@...glegroups.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Apache/PHP REQUEST_METHOD XSS Vulnerability

This is a case of poor-programming, on the script coder's part, it is not so
much a vunerability.

That variable only contains what it is sent by apache. it doesn't parse it.
nor is it supposed to. If you want to ensure there is no XSS going on, parse
the variable, escape characters, etc as it IS user input.

This CAN be a vulnerability with individual scripts, however, it is not a
vuln
with PHP or Apache.

On Monday 23 April 2007 17:31, Michal Majchrowicz wrote:
> There exist a flaw in a way how Apache and php combination handle the
> $_SERVER array.
> If the programmer writes scrip like this:
> <?php
>               echo $_SERVER['REQUEST_METHOD'];
> ?>
> He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE
> and all that stuff. However this is not true, since Apache accepts
> requests that look like this:
> GET<script>alert(document.coookie);</script> /test.php HTTP/1.0
> And the output for this would be:
> GET<script>alert(document.coookie);</script>
> Of course it is hard to exploit (I think some Flash might help ;)) and
> I don't know if it is exploitable at all. But programmers should be
> warned about this behaviour. You can't trust any  variable in the
> $_SERVER table!
> Regards Michal Majchrowicz.
>


2007/4/24, Michał Majchrowicz <mmajchrowicz@...il.com>:
>
>
> I agree. But (as a programmer) would you assume that there can be such
> things in the REQUEST_METHOD? The flaw is that Apache accepts anything
> after the valid request i.e. GET. There should be an error the the
> request was not correct.
> Regards Michal.
>
> On 4/24/07, Kradorex Xeron <admin@...ibase.ca> wrote:
> > This is a case of poor-programming, on the script coder's part, it is
> not so
> > much a vunerability.
> >
> > That variable only contains what it is sent by apache. it doesn't parse
> it.
> > nor is it supposed to. If you want to ensure there is no XSS going on,
> parse
> > the variable, escape characters, etc as it IS user input.
> >
> > This CAN be a vulnerability with individual scripts, however, it is not
> a vuln
> > with PHP or Apache.
> >
> > On Monday 23 April 2007 17:31, Michal Majchrowicz wrote:
> > > There exist a flaw in a way how Apache and php combination handle the
> > > $_SERVER array.
> > > If the programmer writes scrip like this:
> > > <?php
> > >               echo $_SERVER['REQUEST_METHOD'];
> > > ?>
> > > He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE
> > > and all that stuff. However this is not true, since Apache accepts
> > > requests that look like this:
> > > GET<script>alert(document.coookie);</script> /test.php HTTP/1.0
> > > And the output for this would be:
> > > GET<script>alert(document.coookie);</script>
> > > Of course it is hard to exploit (I think some Flash might help ;)) and
> > > I don't know if it is exploitable at all. But programmers should be
> > > warned about this behaviour. You can't trust any  variable in the
> > > $_SERVER table!
> > > Regards Michal Majchrowicz.
> > >
> > > _______________________________________________
> > > Full-Disclosure - We believe in it.
> > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > > Hosted and sponsored by Secunia - http://secunia.com/
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/