0

In my frontend I have something like this:

article = httpLibrary.get('api.mysite.com/articles/' + articleId);

Where articleId is taken from a URL query parameter (it's injectable).

Is this exploitable in any way?

I was thinking of trying to inject a newline and see if I can make it perform two requests. That way I would be able to return any data I want if the second, malicious, request returns first. However, injecting CRLF and NULL bytes did nothing.

2
  • If this is a problem depends on the details of how httpLibrary.get is implemented on the client side and how the server reacts to such a request (i.e. application logic server side). Nothing of this is known which makes the question too broad. Commented Jul 4, 2019 at 8:26
  • 1
    Probably not vulnerable, but it´s good practice to validate input anyway. If articleId should be all numbers, make sure it is all numbers.
    – Anders
    Commented Jul 4, 2019 at 8:39

2 Answers 2

1

Like the other committers says: it is dependent on the implementation of the httpLibrary.get.

You can simplify the httpLibrary.get to a function, it can do anything from just NOP to run a complete job. Before the shellshock the programmers would not notice that environment variable could cause the RCE.

You can follow the OWASP Top 10 - A1 Injection: always using the safe API, white-list server-side input validation, escape special characters and others.

1

This depends on what you could do with an injection; article would be of your choice, but this needn't be helpful.

Nonetheless, if httpLibrary.get does take a URL string, you can easily inject this and return arbitrary data for article:

Setting articleId to @yourdomain.tld/yourpath should make everything in front of it a user name for http basic auth.

2
  • If I could return arbitrary data, then that would allow for XSS. That's true that HTTP basic auth works, but unfortunately, if you try this: https://api.mysite.com:[email protected] Then the request really will be made to malicious.site.com. However,if you try this: https://api.mysite.com/articles/1:[email protected] Then the request is instead made to api.mysite.com. Commented Jul 5, 2019 at 11:18
  • Like I said, it depends on the implementation. Was worth a shot, tho
    – Tobi Nary
    Commented Jul 5, 2019 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .