2

I'm assessing security of a webportal for a client and I found a vulnerability.

In the PHP, the code parses a user supplied URL, finds hostname, then does this:

fsocketopen("http://"$URL_HOST", 80); fwrite("GET /".$URL_URL);

Other than making server to make HTTP requests (potential spamming or making server to make HTTP requests etc.) is there any other potential bugs associated to this? I control the full URL and can provide arbitrary hostname + URL + port (since its old PHP, it uses ":" after URL for port instead of its hardcoded port)

1
  • 1
    Just like with your last post, this isn't a small security blunder. This is obviously one of many legacy applications that is full of security holes due to developers not actually knowing what they are doing. If you haven't found any truly destructive security vulnerabilities yet, I'm sure it will only be a matter of time. Sounds fun! Jan 15 '18 at 20:11
1

Since you have full control over both variables and the ports being opened, your best bet for doing more with this vulnerability is to keep in mind that many internet protocols are just plain text commands sent over an open socket. The significance of this fact is that sending an HTTP request to an open SMTP server can actually trick the SMTP server into sending an email. Chrome actually blocks any attempts to access port 25 via your browser as a result. Here is a good run-down:

https://jazzy.id.au/2012/08/23/why_does_chrome_consider_some_ports_unsafe.html

The importance here is that you can use the vulnerable server not just to call arbitrary HTTP sites, but you can potentially also use it to spam SMTP servers (resulting in actual emails being sent) and potentially other internet-connected services.

Granted, this isn't a huge leap from where you already are, but you never know what more fun this might give you. If for instance this server is trusted for email sending, you may be able to send emails as the company without having it filtered out as spam. That's not a small thing.

It's possible the hard-coded http in the fsocketopen call may be enough to kill the email-sending idea, but it is definitely worth trying. Again, there isn't really anything "special" to differentiate http requests from SMTP requests, so if you can find and connect to a server over the proper port, the fact that PHP considers it an http request doesn't really matter if the remote server accepts your connection.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.