lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-id: <4E1A512A.26842.9CF884F0@nick.virus-l.demon.co.uk> Date: Mon, 11 Jul 2011 13:26:02 +1200 From: Nick FitzGerald <nick@...us-l.demon.co.uk> To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk> Subject: Re: Joomla Content Manager 1.5 Mail Fun Tomm Foo wrote: > This might be old, but I find this interesting enough that Ill share just in > case. Dunno if this specific one is know, but spammers (especially 419'ers) have been abusing these poorly implemented "Email a friend" type functions on web pages for quite some time... > By accident I ran across several sites that allow you to send an email > containing a link to whatever site you please from any sender you choose, > all under the header of a presumably legitimate site. > > An example, > > https://www.1stprioritymortgage.com/index.php?option=com_mailto&tmpl=component&link=aHR0cHM6Ly93d3cuMXN0cHJpb3JpdHltb3J0Z2FnZS5jb20vaW5kZXgucGhwP3ZpZXc9YXJ0aWNsZSZpZD04NCUzQXNpdGUtbWFwJm9wdGlvbj1jb21fY29udGVudCZJdGVtaWQ9OTM= > > (found by clicking the mail button on all the article pages containing this > software) will send the recipient you designate a link to the page you were > viewing. However, by changing the base64 code above to a link of your own > works as well, thus > > https://www.1stprioritymortgage.com/index.php?option=com_mailto&tmpl=component&link=Cmh0dHA6Ly93d3cuZXZpbGdheXNleC5jb20vdmlydXMucGhwPz1sb2wK > > will be sent to the recepient instead. Spoof a legitimate page and you could > easily snag the cluesless plebe into visiting somewhere much more nasty. Of course, that Base64-encoded string need not decode to a URL... You can Base64 encode any message body you desire (length limits not tested) and stick that in as the link parameter to the URL. The server- side processor happily decodes that and adds that text to its own (quite brief in this case) message body. As the sent messages are: Content-Type: text/plain some of the cleverness that other such "Email a friend" forms have (quite unintentionally) allowed with HTML content are not available. Oh, and there is an issue with "+" chars in the Base64-encoded text passed back to the form processor (they get turned into spaces and dropped, as you may expect). A good thing this particular instance has that many others don't is that it tries to prevent multiple addresses being entered via the form, making it somewhat less spammer-friendly (though I've seen many instances where 419's apparently c'n'p the same stuff over and over into the same form, with a different Email address each time or maybe have automated it to do one address at a time). Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists