8

Say a PHP page accepts URL path as a POST parameter (like the answer to this question):

$path = $_POST['url_path'];

file_get_contents('http://example.com' . $path);

A maliicious user POSTs url_path as @evil.com/stuff.html.

As the code takes the user input and appends it without a delimiter to end the username section (e.g. ?, /), $path ends up as:

http://example.com@evil.com/stuff.html

which means username example.com accessing http://evil.com/stuff.html.

Is there already a specific name for this type of attack? The closest I found was Semantic URL attack, however this seems more syntaxic. It appears to be a type of URL obfuscation, however as it is on the server and not visible to the end-user in the address bar it is a slightly different type of attack to Phishing.

Note: The code is also vulnerable to other types of domain manipulation such as appending something to change the interpretation to another top level domain (e.g. POSTing .uk to change example.co). So on that basis I would just call it a general string concatenation flaw rather than an attack specifically relating to URLs - however, I'd like to put this out to the floor.

4

Server Side Request Forgery (SSRF) where the server makes a web request to a user controlled URL. MITRE has assigned this as CWE-918.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.