Re: Secure Form Script?

From: Michael Rice (michael_at_riceclan.org)
Date: 05/12/04

  • Next message: Stephen Samuel: "Re: Secure Form Script?" 
    To: "Peter H. Lemieux" <phl@cyways.com>
Date: Wed, 12 May 2004 08:23:34 -0500

    > Can someone point me to a discussion about the issues involved with
    > hijacking web forms? In the applications I write, the destination address
    > is usually stored on the server, either in the script itself, or in a
    > configuration file, or in a database. I don't see how someone could use
    > such a script to change the destination address and point it at a list
    > of addresses belonging to spam victims.

    It's usually not sufficient to store the to addresses on the server
    and/or obfuscate the parameters used for the other input fields.

    Consider a form that constructs the email like:

    Date: $local->date
    From: $form->from
    To: $local->to
    Subject: $form->subject

    $form->body

    So, to hijack this form, I would construct a subject like:

    $form->subject = Hi, I'm hijacking you\r\nFrom:
    someplace@silly.or.annoying\r\nTo: whomever@i.want,
    and@all.their.friends

    Then your MTA does the rest.

    The moral here is to always check your inputs. 

    -- 
Michael Rice <michael@riceclan.org>
  • Next message: Stephen Samuel: "Re: Secure Form Script?"

    Relevant Pages

    • PublishObjects lockup
      ... HOW CAN I MODIFY THIS SCRIPT TO PREVENT LOCKUP IN THE CASE OF FAILURE? ... Excel when the destination server for PublishObjects is not available. ...
      (microsoft.public.excel.programming)
    • RE: Secure Form Script?
      ... Or you can write your own script in Perl ... Even if manage to hijack the fields due to improperly vetted ... the destination ... > It's usually not sufficient to store the to addresses on the server ...
      (Focus-Linux)
    • Re: DTS Transfer Job Fails
      ... If you are just transferring jobs, why not script them and run the script at ... after changing any server specific info you need? ... destination server and allows me to check only the ones that are not. ...
      (microsoft.public.sqlserver.dts)
    • Re: Same Internal Server Error from last two days
      ... I am trying to run a Hello World Perl Script in Apache 2.2. ... But its constantly giving me Internal Server Error.The script ... # have to place corresponding `LoadModule' lines at this location so the ...
      (perl.beginners)
    • Re: Same Internal Server Error from last two days
      ... I am trying to run a Hello World Perl Script in Apache 2.2. ... But its constantly giving me Internal Server Error.The script Runs perfectly fine from the command prompt. ... # This is the main Apache HTTP server configuration file. ... LoadModule actions_module modules/mod_actions.so ...
      (perl.beginners)