Attachment 665755 Details for Bug 888523 – CVE-2012-5647-restorer.php.patch

[patch] CVE-2012-5647-restorer.php.patch

CVE-2012-5647-restorer.php.patch (text/plain), 1.62 KB, created by Kurt Seifried on 2012-12-18 20:56:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-12-18 20:56:48 UTC

Size: 1.62 KB

patch

obsolete

>From 2d8ba46e55bcbcebd12d7077eccd52cdad3ba4e7 Mon Sep 17 00:00:00 2001
>From: Michael Scherer <misc@zarb.org>
>Date: Tue, 27 Nov 2012 08:00:54 +0100
>Subject: [PATCH 2/2] Force the complete url in the redirection after
> restoring a idled application
>
>This is mandated by HTTP/1.1 norm, and prevent unsecure redirection.
>
>Since $_SERVER["PATH_INFO"] is provided by the http client and the url
>is passed back without filtering, someone could create a crafted url
>who will redirect a user to any remote url while still appearing legit.
>
>For example, http://foo.example.org/http://attacker.example.org would be
>rewritten internally as http://foo.example.org/restorer.php/1234/http://attacker.example.org
>and then redirect the client to http://attacker.example.org, which can
>be used for phising attempts, among others.
>
>Other issues may lurk in this page, especially since HTTP_HOST is client provided.
>---
> node-util/www/html/restorer.php | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/node-util/www/html/restorer.php b/node-util/www/html/restorer.php
>index ec61cef..f7b840d 100755
>--- a/node-util/www/html/restorer.php
>+++ b/node-util/www/html/restorer.php
>@@ -5,7 +5,9 @@ if (preg_match('/[0-9a-f]{32}/', $uuid)) {
>     shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
>     sleep(2);
>     $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
>-    header("Location: $url");
>+    $host = $_SERVER['HTTP_HOST'];
>+    $proto = "http" . ( $_SERVER['HTTPS'] ? 's' : '' ) . '://';
>+    header("Location: $proto$host$url");
> } else {
>     // someone is trying to attack
>     error_log("Wrong uuid $uuid given to restorer.php");
>-- 
>1.8.0
>

Actions: View | Diff

Attachments on bug 888523: 665755