OXID eShop 'index.php' Multiple HTTP Response Splitting Vulnerabilities
BID:66371
Info
OXID eShop 'index.php' Multiple HTTP Response Splitting Vulnerabilities
| Bugtraq ID: | 66371 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-2017 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 20 2014 12:00AM |
| Updated: | Mar 20 2014 12:00AM |
| Credit: | Heiko Frenzel |
| Vulnerable: |
OXID eSales AG OXID eShop Professional 4.7.8 OXID eSales AG OXID eShop Professional 4.3 OXID eSales AG OXID eShop Professional 4.1.2 OXID eSales AG OXID eShop Professional 4.1.1 OXID eSales AG OXID eShop Professional 4.1 OXID eSales AG OXID eShop Professional 4.2.0 OXID eSales AG OXID eShop Professional 4.1.6 OXID eSales AG OXID eShop Professional 4.1.5 OXID eSales AG OXID eShop Professional 4.1.4 OXID eSales AG OXID eShop Professional 4.1.3 OXID eSales AG OXID eShop Enterprise 5.0.8 OXID eSales AG OXID eShop Enterprise 5.0.7 OXID eSales AG OXID eShop Community 4.7.8 OXID eSales AG OXID eShop Community 4.3 OXID eSales AG OXID eShop Community 4.2 OXID eSales AG OXID eShop Community 4.1.6 OXID eSales AG OXID eShop Community 4.1.5 OXID eSales AG OXID eShop Community 4.1.4 OXID eSales AG OXID eShop Community 4.1 OXID eSales AG OXID eShop Community 4.1.3 OXID eSales AG OXID eShop Community 4.1.2 OXID eSales AG OXID eShop Community 4.1.1 |
| Not Vulnerable: |
OXID eSales AG OXID eShop Professional 4.8.4 OXID eSales AG OXID eShop Professional 4.7.11 OXID eSales AG OXID eShop Enterprise 5.1.4 OXID eSales AG OXID eShop Enterprise 5.0.11 OXID eSales AG OXID eShop Community 4.8.4 OXID eSales AG OXID eShop Community 4.7.11 |
Discussion
OXID eShop 'index.php' Multiple HTTP Response Splitting Vulnerabilities
OXID eShop is prone to multiple HTTP-response-splitting vulnerabilities because it fails to properly sanitize user-supplied input.
Attackers can leverage these issues to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
OXID eShop is prone to multiple HTTP-response-splitting vulnerabilities because it fails to properly sanitize user-supplied input.
Attackers can leverage these issues to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Exploit / POC
OXID eShop 'index.php' Multiple HTTP Response Splitting Vulnerabilities
To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI.
To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
OXID eShop 'index.php' Multiple HTTP Response Splitting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
OXID eShop 'index.php' Multiple HTTP Response Splitting Vulnerabilities
References:
References:
- OXID eShop Homepage (OXID eSales AG)
- OXID eSales AG Security Bulletin 2014-002 (OXID eShop)