How do we filter this HTTP_REFERER ? ---------- Forwarded Message ---------- Return-path: Received: from outgoing.securityfocus.com [66.38.151.6] by osbtown.com [208.1.39.12] with SMTP (MDaemon.v3.5.7.R) for ; Thu, 02 Aug 2001 02:07:44 -0700 Received: from lists.securityfocus.com (lists.securityfocus.com [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id 91D31259B0B; Wed, 1 Aug 2001 23:20:43 -0600 (MDT) Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm Precedence: bulk List-Id: List-Post: mailto:bugtraq@securityfocus.com List-Help: mailto:bugtraq-help@securityfocus.com List-Unsubscribe: mailto:bugtraq-unsubscribe@securityfocus.com List-Subscribe: mailto:bugtraq-subscribe@securityfocus.com Delivered-To: mailing list bugtraq@securityfocus.com Delivered-To: moderator for bugtraq@securityfocus.com Received: (qmail 3141 invoked from network); 1 Aug 2001 23:16:53 -0000 Date: Thu, 2 Aug 2001 01:09:42 +0200 (CEST) From: Maurycy Prodeus X-Sender: z33d@cubx.elando.pl To: bugtraq@securityfocus.com Subject: suse: sdbsearch.cgi vulnerability Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-MDRcpt-To: phil@osbtown.com X-MDRemoteIP: 66.38.151.6 X-Return-Path: bugtraq-return-1479-phil=osbtown.com@securityfocus.com X-MDaemon-Deliver-To: phil@osbtown.com Reply-To: bugtraq-return-1479-phil=osbtown.com@securityfocus.com Status: R X-Status: N Hello, I found weakness in sdbsearch.cgi script which is a part of Suse distribution. This is perl script and since Suse 7.1 they have introduced some form of protection (interpreter is called with tainting checking). However, I think it isn't enough and this bug still may produce danger. Sdbsearch.cgi trusts content of HTTP_REFERER variable which is set by client side during http's requests. Piece of this data is used to locating file with keywords and referenced files. If there is possiblity to put such file on attacked host (i.e. upload through ftpd) with special content, sdbsearch will use open() to get access to match files. So we can make standard open() pipe based attack (only without -T option). Name of uploaded file has to be "keylist.txt" because we manipulate only on pathname, using double dots. Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this: GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0 Referer: http://szachy.org/../../../../../tmp (very deep traversal because we don't know what is DOCUMENT_ROOT) and an example content of our /tmp/keylist.txt create like this: $ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt After successful attempt there will be "exploitable" file in /tmp directory. Affected system: Suse 6.x 7.x (7.1 and 7.2 have tainting protection, but even then we can pass sdbsearch files which shouldn't be read) Patch: Just filter HTTP_REFERER variable. - z33d -- je Art_of_self_destruct pushl %eax pushl %eax pushl %ebx pushl %ebx popl %ecx ----== http://z33d.eth-security.net ==---- pushl %eax pushl %eax pushl %ebx pushl %ebx Art_of_self_destruct: hlt Hello, I found weakness in sdbsearch.cgi script which is a part of Suse distribution. This is perl script and since Suse 7.1 they have introduced some form of protection (interpreter is called with tainting checking). However, I think it isn't enough and this bug still may produce danger. Sdbsearch.cgi trusts content of HTTP_REFERER variable which is set by client side during http's requests. Piece of this data is used to locating file with keywords and referenced files. If there is possiblity to put such file on attacked host (i.e. upload through ftpd) with special content, sdbsearch will use open() to get access to match files. So we can make standard open() pipe based attack (only without -T option). Name of uploaded file has to be "keylist.txt" because we manipulate only on pathname, using double dots. Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this: GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0 Referer: http://szachy.org/../../../../../tmp (very deep traversal because we don't know what is DOCUMENT_ROOT) and an example content of our /tmp/keylist.txt create like this: $ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt After successful attempt there will be "exploitable" file in /tmp directory. Affected system: Suse 6.x 7.x (7.1 and 7.2 have tainting protection, but even then we can pass sdbsearch files which shouldn't be read) Patch: Just filter HTTP_REFERER variable. - z33d -- je Art_of_self_destruct pushl %eax pushl %eax pushl %ebx pushl %ebx popl %ecx ----== http://z33d.eth-security.net ==---- pushl %eax pushl %eax pushl %ebx pushl %ebx Art_of_self_destruct: hlt -------------------------------------------------------