SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Server/CGI)  >   OmniHTTPd Vendors:   Omnicron Technologies
OmniHTTPd Web Server Input Validation Holes in Sample Applications Let Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1005137
SecurityTracker URL:  http://securitytracker.com/id/1005137
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 26 2002
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  

Description:   Several vulnerabilities were reported in sample pages and applications provided with the OmniHTTPd web server. A remote user can conduct cross-site scripting attacks against web site users.

One input validation flaw was reported in the test.php script of OmniHTTPd. The script displays user-supplied values without filtering. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running OmniHTTPd and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit URL is provided:

http://localhost/test.php?%3CSCRIPT%3Ealert%28document.URL%29%3C%2FSCRIPT%3E

A similar flaw is reported in the 'test.shtml' script. A demonstration exploit URL is provided:

http://localhost/test.shtml?%3CSCRIPT%3Ealert(document.URL)%3C%2FSCRIPT%3E

Another bug was reported in '/cgi-bin/redir.exe'. A remote user can create a specially crafted URL that will inject HTML to be displayed by the application. The remote user can inject url-encoded newline characters ('%0D%0A') into the URL query parameter to control the headers following the "Location" header. A demonstration exploit URL is provided:

http://localhost/cgi-bin/redir.exe?URL=http%3A%2F%2Fwww%2Eyahoo%2Ecom%2F%0D%
0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running OmniHTTPd, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.omnicron.ca/ (Links to External Site)
Cause:   Input validation error
Underlying OS:   Windows (NT), Windows (95), Windows (98), Windows (2000)

Message History:   None.


 Source Message Contents

Date:  Sun, 25 Aug 2002 11:50:11 -0500
Subject:  [VulnWatch] More OmniHTTPd Problems


I've discovered another vulnerability in one of the OmniHTTPd sample apps.
This time, the culprit is "/cgi-bin/redir.exe".  This app is vulnerable to a
newline injection issue.  The vulnerability occurs because the "URL" query
parameter (case sensitive) is decoded and placed directly into the response
as the "Location" header.  If an attacker places urlencoded newlines
("%0D%0A") into the parameter, the headers following the "Location" header,
as well as the resultant entity, can be controlled.

I had a tough time exploiting this vulnerability to add headers, because
OmniHTTPd would not add my header. :-(  However, I was able to exploit this
vulnerability to produce the following output:

[Begin Server Response]
HTTP/1.0 302 Redirection
Content-Type: text/html
Date: Sun, 25 Aug 2002 16:36:39 GMT
Location: http://www.yahoo.com/
Server: OmniHTTPd/2.10

<script>alert(document.URL)</script>


[End Server Response]

This will pop up an alert, and then redirect to yahoo.com on browsers that
display redirect entities (IE will not work for this)

I was a bit puzzled by the "Server" header between the Location and the
entity, but I figured out that OmniHTTPd was inserting the header after CGI
processing was complete.

Exploit URL:

http://localhost/cgi-bin/redir.exe?URL=http%3A%2F%2Fwww%2Eyahoo%2Ecom%2F%0D%
0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E

"The reason the mainstream is thought
of as a stream is because it is
so shallow."
                     - Author Unknown



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC