Re: Web Browsers vulnerable to the Extended HTML Form Attack (IE and OPERA)

From: jon schatz (jon@divisionbyzero.com)
Date: 02/07/02 

From: jon schatz <jon@divisionbyzero.com>
To: Mark Renouf <mark@tweakt.net>
Date: 07 Feb 2002 13:20:08 -0800

On Thu, 2002-02-07 at 08:40, Mark Renouf wrote:
> obscure wrote:
> FYI: Mozilla 0.9.8+ gives an alert:
> "Access to the port number given has been disabled for security reasons."

this is one of those ancient netscape-isms. there are certain ports that
you've never been able to connect to. While i can't seem to find an
exact list anywhere, i did find this in some iplanet docs, and i assume
this is implemented the same way in the mozilla core:

"To avoid protocol spoofing by rouge/misconfigured URLs, iPlanet Web
Proxy Server does not allow clients to connect on certain reserved
ports.

If using an HTTP URL, the client may not configure the URL to use the
following ports:

1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 23, 25, 37, 42, 43, 53, 70, 77, 79,
87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 135, 143,
389, 512, 513, 514, 515, 526, 530, 531, 532,540, 556, 601, 6000"

http://docs.iplanet.com/docs/manuals/proxy/36/adminnt/resport.htm

also (just for grins), i tried something similar with apache (since port
80 is ok):

[jon@opiate jon]$ nc localhost 80
GET /<script>alert(document.cookie)</script> HTTP/1.0

HTTP/1.1 404 Not Found
<--snip-->
<H1>Not Found</H1>
<--snip-->
The requested URL /&lt;script&gt;alert(document.cookie)&lt;/script&gt;
was not found on this server.<P>
<HR>

i also tested with squid (notice port 3128 isn't in the blocked list):

HTTP/1.0 400 Bad Request
<--snip-->
While trying to retrieve the URL:
<A
HREF="/&lt;script&gt;alert(document.cookie)&lt;/script&gt;">/&lt;script&gt;alert(document.cookie)&lt;/script&gt;</A>
<--snip-->

both of them encoded the <>'s.

and finally, i tried with iis. i got back an error page that made no
mention of the url i requested.

there are alot of other services on the web that may or may not echo
back commands though, so i bet there are more versions of this same
exploit.

-jon 

-- 
jon@divisionbyzero.com || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus?: www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing."

Relevant Pages

  • Re: adding machine to domain with NATed IPs
    ... sounds that the DCs are not reaching the clients ... weight 100, port 389, target srv5.mydomain.local ...
    (microsoft.public.windows.server.active_directory)
  • Re: adding machine to domain with NATed IPs
    ... sounds that the DCs are not reaching the clients ... Type: SRV (Service location) ... weight 100, port 389, target srv5.mydomain.local ...
    (microsoft.public.windows.server.active_directory)
  • Re: DDoS to microsoft sites
    ... The primary difference between the two clients is that the first port scan I ... > - netbios (brute force attack on Administrator account) ... I'm guessing that the SQL server is the infection vector in both these ...
    (Incidents)
  • Re: Help need desperately!
    ... Changing from port 80 is not required. ... Inventory information began flowing properly. ... All of the clients seemed to install with the new ... >> found our problem to be in our TCP port configuration on the Server. ...
    (microsoft.public.sms.inventory)
  • Re: adding machine to domain with NATed IPs
    ... sounds that the DCs are not reaching the clients or vice versa? ... weight 100, port 389, target srv5.mydomain.local ...
    (microsoft.public.windows.server.active_directory)
Quantcast