Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 17 Feb 2016 15:04:42 +0530
From: Sandeep Kamble <sandeepk.l337@...il.com>
To: Florent Daigniere <florent.daigniere@...stmatta.com>
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Re: Umbraco - The open source ASP.NET CMS Multiple Vulnerabilities

I think CVE-2012-1301 is more about behaving like an open proxy. In this
bug attacker able to perform SSRF and using this attacker able to perform
port scanning etc.
On 17 Feb 2016 13:30, "Florent Daigniere" <florent.daigniere@...stmatta.com>
wrote:

> On Tue, 2016-02-16 at 17:23 -0500, cve-assign@...re.org wrote:
> > > http://issues.umbraco.org/issue/U4-7457
> > > SSRF
> >
> > > the feedproxy.aspx is used to access the external resources using
> > > the URL GET parameter.
> >
> > > http://local/Umbraco/feedproxy.aspx?url=http://bobsite/index
> > >
> > > once you change the URL to the
> > > http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:80/index,
> > > you able
> > > to access the localhost application of the server.
> > >
> > > Using this payload change the port number to perform port scanning
> > > of the
> > > server. It will be helpful to find the more details of the server.
> > > For example:
> > >
> > > http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:25/index
> > > http://local/Umbraco/feedproxy.aspx?url=http://127.0.0.1:8080/index
> > >
> > > If the port number is closed, you will find the error message on
> > > the
> > > feedproxy.aspx page.
> >
> > Use CVE-2015-8813.
> >
>
> How different is it from CVE-2012-1301 ? Have they re-introduced it?
>
> Florent

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ