Full Disclosure mailing list archives
Re: Apache/PHP REQUEST_METHOD XSS Vulnerability
From: "Michal Majchrowicz" <m.majchrowicz () gmail com>
Date: Tue, 24 Apr 2007 01:09:51 +0200
Hi. New info: <script>alert(document.cookie);</script> /test.php HTTP/1.0 I have no idea why Apache accepts this request but it does :) Regards Michal.
On 4/24/07, Kradorex Xeron <admin () digibase ca> wrote:This isn't only a problem with that specific variable, it is also a problem with any user-defined variable, i.e. <? echo $_GET['page']; ?> can be XSS'd with script.php?page=<b>blah</b> However: <? echo htmlentities($_GET['page']); ?> is much harder to exploit to inject malicious code. I beleive the following: If your program/script accepts any user input, never assume something else will block the exploit of your program, always impliment sanity checks, and/or strip nonsense out of the input. On Monday 23 April 2007 18:21, you wrote:I agree. But (as a programmer) would you assume that there can be such things in the REQUEST_METHOD? The flaw is that Apache accepts anything after the valid request i.e. GET. There should be an error the the request was not correct. Regards Michal. On 4/24/07, Kradorex Xeron <admin () digibase ca> wrote:This is a case of poor-programming, on the script coder's part, it is not so much a vunerability. That variable only contains what it is sent by apache. it doesn't parse it. nor is it supposed to. If you want to ensure there is no XSS going on, parse the variable, escape characters, etc as it IS user input. This CAN be a vulnerability with individual scripts, however, it is not a vuln with PHP or Apache. On Monday 23 April 2007 17:31, Michal Majchrowicz wrote:There exist a flaw in a way how Apache and php combination handle the $_SERVER array. If the programmer writes scrip like this: <?php echo $_SERVER['REQUEST_METHOD']; ?> He will assume that REQUEST_METHOD can only by: GET,POST,OPTIONS,TRACE and all that stuff. However this is not true, since Apache accepts requests that look like this: GET<script>alert(document.coookie);</script> /test.php HTTP/1.0 And the output for this would be: GET<script>alert(document.coookie);</script> Of course it is hard to exploit (I think some Flash might help ;)) and I don't know if it is exploitable at all. But programmers should be warned about this behaviour. You can't trust any variable in the $_SERVER table! Regards Michal Majchrowicz. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Apache/PHP REQUEST_METHOD XSS Vulnerability Michal Majchrowicz (Apr 23)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Kradorex Xeron (Apr 23)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Michał Majchrowicz (Apr 23)
- Message not available
- Message not available
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Michal Majchrowicz (Apr 23)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Michał Majchrowicz (Apr 23)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Kradorex Xeron (Apr 24)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Michał Majchrowicz (Apr 24)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Kradorex Xeron (Apr 23)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability عبد الله احمد عنان (Apr 24)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Vincent Archer (Apr 25)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Kradorex Xeron (Apr 25)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Vincent Archer (Apr 25)
- Re: Apache/PHP REQUEST_METHOD XSS Vulnerability Michal Majchrowicz (Apr 23)
- Re: [VulnWatch] Apache/PHP REQUEST_METHOD XSS Vulnerability Michal Majchrowicz (Apr 24)