Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
On Tue, 2007-04-24 at 20:03 +0300, عبد الله احمد عنان wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. In that case, nobody's talking about vulnerabilities on this list, only poor programming. :) The problem in here is that the programmer assumes that the variables do have a proper value checking done prior to handling off to the script engine. HTTP_METHOD is well defined. One would assume apache has validated the method somehow. Unfortunately, this assumption was flawed. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. However, it (apache) should perform integrity checks, because it has the capacity to do so. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. Not with PHP. But I would agree with the original programmer that apache is in fault here. Apache should have done the expected work, and validated that the request was standards-compliant. It didn't, and that opens up a huge chasm in which plenty of problems, vulnerabilities and others, may hide. -- Vincent ARCHER [EMAIL PROTECTED] Tel : +33 (0)1 40 07 47 14 Fax : +33 (0)1 40 07 47 27 Deny All - 23, rue Notre Dame des Victoires - 75002 Paris - France ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
On Wednesday 25 April 2007 05:35, Vincent Archer wrote: On Tue, 2007-04-24 at 20:03 +0300, عبد الله احمد عنان wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. In that case, nobody's talking about vulnerabilities on this list, only poor programming. :) Vulnerabilities are results of poor programming. The problem in here is that the programmer assumes that the variables do have a proper value checking done prior to handling off to the script engine. HTTP_METHOD is well defined. One would assume apache has validated the method somehow. If you properly code the scripts, Apache's acceptance of misc data in the method field is not a vulnerability, it is a feature that could be used to make that field extensible with minimal effort. i.e. a script could be designed to send out data based on different methods not listed in the RFC. Unfortunately, this assumption was flawed. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. However, it (apache) should perform integrity checks, because it has the capacity to do so. True. but Apache should not facilitate lazy programming on script programmers part, the more you baby sit people, the more they will rely on that babysitting and not do it for themselves because they will inherently assume that they have a 'safety net', thus if the script is run on a server without that safety net THAT server gets labeled as vunlnerable when without that script the server is not vulnerable. What are we going to do next? get the HTTPD to valadate the URL-based queries (i.e. script.php?var=value) to prevent unintended input (i.e. viewfile.php?file=../../../file )? This is a SCRIPT problem. not a problem with the HTTPD. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. Not with PHP. But I would agree with the original programmer that apache is in fault here. Apache should have done the expected work, and validated that the request was standards-compliant. It didn't, and that opens up a huge chasm in which plenty of problems, vulnerabilities and others, may hide. From RFC 2616 Section 5.1.1: The list of methods allowed by a resource can be specified in an Allow header field (section 14.7). The return code of the response always notifies the client whether a method is currently allowed on a resource, since the set of allowed methods can change dynamically. The standards don't say anything about a static list of methods being required. so Apache is compliant there. It is a per-script problem for not parsing the raw data provided to the script properly. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
This isn't only a problem with that specific variable, it is also a problem with any user-defined variable, i.e. ? echo $_GET['page']; ? can be XSS'd with script.php?page=bblah/b However: ? echo htmlentities($_GET['page']); ? is much harder to exploit to inject malicious code. I beleive the following: If your program/script accepts any user input, never assume something else will block the exploit of your program, always impliment sanity checks, and/or strip nonsense out of the input. On Monday 23 April 2007 18:21, Michał Majchrowicz wrote: I agree. But (as a programmer) would you assume that there can be such things in the REQUEST_METHOD? The flaw is that Apache accepts anything after the valid request i.e. GET. There should be an error the the request was not correct. Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
If you use htmlentitles it is still exploitable. The problem is that Apache accepts chars wich it shouldn't. Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This isn't only a problem with that specific variable, it is also a problem with any user-defined variable, i.e. ? echo $_GET['page']; ? can be XSS'd with script.php?page=bblah/b However: ? echo htmlentities($_GET['page']); ? is much harder to exploit to inject malicious code. I beleive the following: If your program/script accepts any user input, never assume something else will block the exploit of your program, always impliment sanity checks, and/or strip nonsense out of the input. On Monday 23 April 2007 18:21, Michał Majchrowicz wrote: I agree. But (as a programmer) would you assume that there can be such things in the REQUEST_METHOD? The flaw is that Apache accepts anything after the valid request i.e. GET. There should be an error the the request was not correct. Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. 2007/4/24, Michał Majchrowicz [EMAIL PROTECTED]: I agree. But (as a programmer) would you assume that there can be such things in the REQUEST_METHOD? The flaw is that Apache accepts anything after the valid request i.e. GET. There should be an error the the request was not correct. Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
Hi. I am not a flash expert but you can find many interesting things about flash and playing with http headers. For instance the case of Expect XSS Vulnerability. I don't know any way to exploit but If I don't know it doesn't mean there isn't one :) Regards Michal. On 4/24/07, InSiStKool [EMAIL PROTECTED] wrote: H Michael, This is interesting. I do able to see the output after injecting the xss statement, but I don't see how is possible to be used. Further, GETscriptalert(document.coookie);/script /test.php HTTP/1.0 I only know we can use nc or telnet to execute the above statement, how can you execute it with a browser like ff or ie? You mentioned some flash might help, can you give me an example? Thanks insistkool On 4/23/07, Michal Majchrowicz [EMAIL PROTECTED] wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
Hi. New info: scriptalert(document.cookie);/script /test.php HTTP/1.0 I have no idea why Apache accepts this request but it does :) Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This isn't only a problem with that specific variable, it is also a problem with any user-defined variable, i.e. ? echo $_GET['page']; ? can be XSS'd with script.php?page=bblah/b However: ? echo htmlentities($_GET['page']); ? is much harder to exploit to inject malicious code. I beleive the following: If your program/script accepts any user input, never assume something else will block the exploit of your program, always impliment sanity checks, and/or strip nonsense out of the input. On Monday 23 April 2007 18:21, you wrote: I agree. But (as a programmer) would you assume that there can be such things in the REQUEST_METHOD? The flaw is that Apache accepts anything after the valid request i.e. GET. There should be an error the the request was not correct. Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apache/PHP REQUEST_METHOD XSS Vulnerability
I agree. But (as a programmer) would you assume that there can be such things in the REQUEST_METHOD? The flaw is that Apache accepts anything after the valid request i.e. GET. There should be an error the the request was not correct. Regards Michal. On 4/24/07, Kradorex Xeron [EMAIL PROTECTED] wrote: This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote: There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: ?php echo $_SERVER['REQUEST_METHOD']; ? He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GETscriptalert(document.coookie);/script /test.php HTTP/1.0 And the output for this would be: GETscriptalert(document.coookie);/script Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
