Re: Kevin Johnson BASE <= 1.3.6 authentication bypass

["Jamie Riden" <jamie.riden () gmail com>]

On 04/06/07, Johnny Storm <johnny653 () gmail com> wrote:
> Basic Analysis and Security Engine (BASE)
> (http://base.secureideas.net/)
>
>
> One more security product with lame bugs...
>
> Let's look at Kevin's authentication code,
> for example in base_main.php (all pages vulnerable):
>
>  [...]
>  64   // Check role out and redirect if needed -- Kevin
>   65   $roleneeded = 10000;
>   66   $BUser = new BaseUser();
>   67   //if (($Use_Auth_System == 1) && ($BUser->hasRole($roleneeded) == 0))
>  68   if ($Use_Auth_System == 1)
>  69   {
>   70       if ($BUser->hasRole($roleneeded) == 0)
>  71       {
>   72           header("Location: $BASE_urlpath/index.php");
>  73       }
>  74   }
>  [...]
>
> Where is bug?
> Yes, your browser will redirect after received location header,
> but what if not? ;-)

[carefully ignoring the rest of the thread...]

Yes, I believe it's good practice to exit(); after a header('Location:
...') - I've certainly tried to make all my code do it as far as
possible. See for example:

"Special attention should be paid when using Location header, however,
as it is used to redirect clients from one page to another. When you
send a Location header, PHP will continue to parse the script after
the header was issued, which wastes system resources and also may let
people see pages they would otherwise not be able to see. As a result,
it's best to use call "exit;" immediately after header("Location:
...") to make sure that nothing happens after the redirect notice has
been sent."  --
http://www.hudzilla.org/phpwiki/index.php?title=Sending_custom_HTTP_headers

That's all I'm saying, as I don't know the code well enough to guess
the security implications and I don't have a running system to test on
right now.

cheers,
 Jamie
-- 
Jamie Riden, CISSP / jamesr () europe com / jamie () honeynet org uk
UK Honeynet Project: http://www.ukhoneynet.org/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/