[NT] WebWasher Classic - HTTP CONNECT Weakness

From: SecuriTeam (support_at_securiteam.com)
Date: 02/09/05

  • Next message: SecuriTeam: "[NT] Vulnerability in the License Logging Service Allows Code Execution (MS05-010)" 
    To: list@securiteam.com
Date: 9 Feb 2005 18:30:07 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      WebWasher Classic - HTTP CONNECT Weakness
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.webwasher.com/> WebWasher Classic is "a well known
    HTTP-URL/Popup/Script filtering proxy which is free for non commercial
    use".

    A flaw in the design of WebWasher allows a malicious attacker to bypass
    firewall rules and ACLs and connect to the machine running WebWasher even
    when not permitted.

    DETAILS

    Vulnerable Systems:
     * WebWasher Classic v3.3 and v.2.2.1 on Windows platform.

    WebWasher Classic supports two modes, a client mode, where it only works
    for the local machine (bound to localhost) and a server mode, where it
    serves as a network proxy (bound to 0.0.0.0).

    When running in server mode, it is possible to connect from remote to tcp
    ports listening on 127.0.0.1 of the WebWasher system. This is a design
    flaw, because CONNECT requests to localhost should be denied. It also may
    be possible to bypass ACL of firewalls that protect the WebWasher system.

    Proof of Concept:
    1) Start a netcat listener on the WebWasher system:
    netcat -L -p 99 -s 127.0.0.1 < hallo.txt
    2) Connect to the WebWasher proxy port (default 8080/tcp)
    3) Enter command "CONNECT 127.0.0.1:99 HTTP/1.0"
    4) As a result, content of hallo.txt will appear.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:Oliver.Karow@gmx.de> Oliver
    Karow.
    The original article can be found at:
    <http://www.oliverkarow.de/research/WebWasherCONNECT.txt>
    http://www.oliverkarow.de/research/WebWasherCONNECT.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Vulnerability in the License Logging Service Allows Code Execution (MS05-010)"