Zone-H.org - Multiple CRLF Injection Vulnerabilities in Google ADWords

Multiple CRLF Injection Vulnerabilities in Google ADWords

Written by Marcelo Almeida (Vympel)

Friday, 15 December 2006

Copyright © 2006 Debasis Mohanty
Multiple CRLF Injection / HTTP Response Splitting
Vulnerabilities In Google AdWords
14th Dec, 2006
Vendor Name: Google
Product Name: Google AdWords (https://adwords.google.com/)
I. Descriptions:
Google AdWords is vulnerable to a new form of application attack technique called HTTP Response
splitting (aka CRLF Injection). HTTP Response Splitting enables an attacker to alter the HTTP
response header structure which can leads to various range of attacks such as web cache poisoning,
temporary defacement, hijacking pages or cross-site scripting (XSS).
This happens since the user input is injected into the value section of http header without properly escaping/removing CRLF characters which can leads to two HTTP responses instead of one response...

II. Affected Links:
GET /select/ProfessionalWelcome?hl=%0d%0afakeheader&null=Go HTTP/1.0
GET /select/Login?hl= hl=%0d%0afakeheader&null=Go HTTP/1.0
III. Proof-of-concept:
[Request Details]
Screenshot a: Custom HTTP response added to “hl” parameter
Copyright © 2006 Debasis Mohanty
[Response Header]
IV. Solution:
Sanitize CR(0x13) and LF(0x10) from the user input or properly encode the output in order to prevent
the injection of custom.
V. History:
11/20/2006 – Vendor Reported
11/20/2006 – Vendor replied back and asked for time to investigate
11/21/2006 – Vendor confirmed the report and asked for time to fix
11/21/2006 – Vendor replied saying, fix will be applied before 14th Dec
12/14/2006 – Public Disclosure
VI. Credits:
Debasis Mohanty
This e-mail address is being protected from spam bots, you need JavaScript enabled to view it
www.hackingspirits.com
For more vulnerabilities visit –
http://hackingspirits.com/vuln-rnd/vuln-rnd.html
Original article

Comments Index (Total Messages: 0)

Post Reply
Name:	Guest
Title:
Comment:
Enter this security word

Powered by a Zone-H(ified) version of AkoComment 3.0!

DISCLAIMER: Forum postings are the opinion of the posting author alone, and should not be taken as the opinion of Zone-h. The author is entirely and solely responsible for all content that he/she uploads, posts, or otherwise transmits via the website. Zone-h is not responsible for such content. However, Zone-h shall have the right, but not the obligation, to delete, move, or edit any content that violates this agreement or is otherwise objectionable as determined by Zone-h in its sole discretion and without notice.

< Prev		Next >

[ Back ]