Remote IIS 5.x and IIS 6.0 Server Name Spoof

[inge_eivind.henriksen@chello.no]

** Inge Henriksen Security Advisory - Full Disclosure Proof of Concept at http://ingehenriksen.blogspot.com/ **

It is possible to remotely spoof the "SERVER_NAME" Microsoft® Internet Information Server® 5.0, 5.1 and 6.0 variable by doing a modified HTTP request. Thus potentially revealing sensitive ASP code through the IIS 500-100.asp error page, the spoof also ope
ns up a potential range of exploits in third party web applications and web services.

Technical Description
Microsoft® Internet Information Server® shows sensitive information if the "SERVER_NAME" IIS 5.x server variable is "localhost". If a ASP page has an error, the code on the fault line in the ASP page is shown in the browser, but only if"SERVER_NAME" IIS s
erver variable is "localhost". One can spoof the "SERVER_NAME" IIS server variable so that it shows whatever one want. Other third party web applications or web services may also be vulnerable if authentication depends on the validity this server variable

[3APA3A]

Dear inge_eivind.henriksen@chello.no,

The bug here is not in ability to spoof SERVER_NAME, because SERVER_NAME
is untrusted data from Host: request header or from proxy-style HTTP
request (like in case of your example). SERVER_NAME is ALWAYS untrusted
data. The bug here is in the way SERVER_NAME is used in error page
genaration. So, you article should be called something like "Microsoft
IIS error page access validation weakness". If any script use
SERVER_NAME in this way, this is vulnerability of the script itself.

--Monday, August 22, 2005, 7:23:08 PM, you wrote to bugtraq@securityfocus=
..com:



ihcn> 6. Try and access it from a remote server with telnet again. This t=
ime use the following HTTP request:
ihcn> GET http://localhost/test.asp HTTP/1.0


--=20
~/ZARAZA
=CD=EE =C3=E0=F0=F0=E8... =FF =E1=E5=E7=F3=F1=EB=EE=E2=ED=EE =EE=F2=E4=E0=
=FE =EF=F0=E5=E4=EF=EE=F7=F2=E5=ED=E8=E5 =E5=EC=F3, =E7=E0
=E2=FB=F1=EE=EA=F3=FE =EF=E8=F2=E0=F2=E5=EB=FC=ED=EE=F1=F2=FC =E8 =EA=E0=EA=
=EE=E5-=F2=EE =EE=F1=EE=E1=E5=ED=ED=EE =ED=E5=E6=ED=EE=E5 =EC=FF=F1=EE. (=
=D2=E2=E5=ED)

[Sacha Faust]

That's correct. Back in 2000-2001 I reported to Microsoft that they =
were using SERVER_NAME variable in some of their sample application =
which made some site even more vulnerable. Any server variable should be =
considered untrusted and validated like any other user input. This is =
the reason why our SecureObject product as been detecting server =
variable usage and protecting them automatically.

For more information visit =
http://www.spidynamics.com/products/devinspectso2003/index.html

Sacha Faust
Manager - SPILabs
S.P.I. Dynamics, Inc.
sfaust@spidynamics.com
www.spidynamics.com
Secure. Protect. Inspect.=20

-----Original Message-----
From: 3APA3A [mailto:3APA3A@SECURITY.NNOV.RU]=20
Sent: August 23, 2005 6:19 AM
To: inge_eivind.henriksen@chello.no
Cc: bugtraq@securityfocus.com
Subject: Re: Remote IIS 5.x and IIS 6.0 Server Name Spoof

Dear inge_eivind.henriksen@chello.no,

The bug here is not in ability to spoof SERVER_NAME, because SERVER_NAME =
is untrusted data from Host: request header or from proxy-style HTTP =
request (like in case of your example). SERVER_NAME is ALWAYS untrusted =
data. The bug here is in the way SERVER_NAME is used in error page =
genaration. So, you article should be called something like "Microsoft
IIS error page access validation weakness". If any script use
SERVER_NAME in this way, this is vulnerability of the script itself.

--Monday, August 22, 2005, 7:23:08 PM, you wrote to =
bugtraq@securityfocus.com:



ihcn> 6. Try and access it from a remote server with telnet again. This =
time use the following HTTP request:
ihcn> GET http://localhost/test.asp HTTP/1.0


--
~/ZARAZA
=EE=CF =E7=C1=D2=D2=C9... =D1 =C2=C5=DA=D5=D3=CC=CF=D7=CE=CF =
=CF=D4=C4=C1=C0 =D0=D2=C5=C4=D0=CF=DE=D4=C5=CE=C9=C5 =C5=CD=D5, =DA=C1 =
=D7=D9=D3=CF=CB=D5=C0 =D0=C9=D4=C1=D4=C5=CC=D8=CE=CF=D3=D4=D8 =C9 =
=CB=C1=CB=CF=C5-=D4=CF =CF=D3=CF=C2=C5=CE=CE=CF =CE=C5=D6=CE=CF=C5 =
=CD=D1=D3=CF. (=F4=D7=C5=CE)