Category Archives: web security

Reflected XSS at LockHeed Martin site

According to the annual tradition I publish a little bit information about LockHeed Martin site security :) It’s just an XSS as the result of several additional web security problems.

XSS exists when you send POST request with an empty body request due to improper Java exception handling (javax.jcr.AccessDeniedException) and incorrect handling of HTTP request methods (HTTP Verb Tampering). For exploitation of the vulnerability you must to spoof the Referer header.

lockheed

Info:

HTTP verb tampering

XSS in Referer header

Advertisements

RomPager 4.07 cross-site scripting vulnerability

During testing IPs that were sources of attacks on php-cgi vulnerability discovered by eindbazen (CVE-2012-1823) accidentally found XSS in Referer header in RomPager/4.07 embedded web server.

GET http://IP.IP.IP.IP/s0urc3_that_not_exists HTTP/1.1

..

Referer: http://dtls.com/”><script>alert(document.cookie)</script&gt;

Tagged , ,

HTTP Headers Pollution (server output pollution)

After reading http://www.acunetix.com/blog/whitepaper-http-parameter-pollution/ I’ve tried to check that one for HTTP headers. So, with Apache/2.2.15 (CentOS) and PHP 5.3.6 I’ve received next result:
Image
So, we can watch the difference between http parameter pollution and http headers pollution for Apache/PHP. In case of HPP with combo PHP/Apache appears only last occurrence of user input in request, and in HHP there is another situation, in which we ca see input concatenation with comma sign. This fact can be very usefull for filters bypassing in some cases.

UPDATE: It can be used for application flow manipulation (not only). For example in cases, in which length of each headers (as element of headers array) checks separately for each header, but subsequently final header used in a way presented on the image above. I didn’t look source codes of Apache closely, but possibly it may be usefull for bypassing latest patch for CVE2012-0053 vulnerability, in which length of value of cookie header (each? final?) must to be less than 80 chars.

P.S. Probably, the reason is depended of the web-server version, but may be this is the same thing exists in older versions.

Tagged , , ,