[Full-Disclosure] More OmniHTTPd Problems

From: Matthew Murphy (full-disclosure@lists.netsys.com)
Date: 08/25/02


From: full-disclosure@lists.netsys.com (Matthew Murphy)
Date: Sun, 25 Aug 2002 11:50:11 -0500

I've discovered another vulnerability in one of the OmniHTTPd sample apps.
This time, the culprit is "/cgi-bin/redir.exe". This app is vulnerable to a
newline injection issue. The vulnerability occurs because the "URL" query
parameter (case sensitive) is decoded and placed directly into the response
as the "Location" header. If an attacker places urlencoded newlines
("%0D%0A") into the parameter, the headers following the "Location" header,
as well as the resultant entity, can be controlled.

I had a tough time exploiting this vulnerability to add headers, because
OmniHTTPd would not add my header. :-( However, I was able to exploit this
vulnerability to produce the following output:

[Begin Server Response]
HTTP/1.0 302 Redirection
Content-Type: text/html
Date: Sun, 25 Aug 2002 16:36:39 GMT
Location: http://www.yahoo.com/
Server: OmniHTTPd/2.10

<script>alert(document.URL)</script>

[End Server Response]

This will pop up an alert, and then redirect to yahoo.com on browsers that
display redirect entities (IE will not work for this)

I was a bit puzzled by the "Server" header between the Location and the
entity, but I figured out that OmniHTTPd was inserting the header after CGI
processing was complete.

Exploit URL:

http://localhost/cgi-bin/redir.exe?URL=http%3A%2F%2Fwww%2Eyahoo%2Ecom%2F%0D%
0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E

"The reason the mainstream is thought
of as a stream is because it is
so shallow."
                     - Author Unknown



Relevant Pages

  • [NT] Multiple OmniHTTPd Issues (CSS)
    ... Scripting vulnerabilities allowing an attacker to cause the server to ... A vulnerability exists in the test.php script of OmniHTTPd. ... decoded and placed directly into the response as the "Location" header. ...
    (Securiteam)
  • [Full-disclosure] SQL Injection in IPB <=2.1.3
    ... The main vulnerability exisits in the lack of sanity checking on the ... the Client-IP header can easily be forged: ... //wait between checking sessions ... echo "."; ...
    (Full-Disclosure)
  • More OmniHTTPd Problems
    ... I've discovered another vulnerability in one of the OmniHTTPd sample apps. ... newline injection issue. ... as the "Location" header. ...
    (Bugtraq)
  • [VulnWatch] More OmniHTTPd Problems
    ... I've discovered another vulnerability in one of the OmniHTTPd sample apps. ... newline injection issue. ... as the "Location" header. ...
    (VulnWatch)