| |
| | Lynx CRLF Injection |
 | | TECHNICAL DETAILS: When a URL is given on the command line or in the WWW_HOME environment variable, Lynx doesn't remove or encode dangerous characters such as space, tab, CR and LF before constructing HTTP queries. |
 | | One scenario is when a program starts Lynx, and the host part of the URL is supplied by the program and the path by its user (something like "lynx http://www.site3.st/$path", where the value of $path is defined by the user). |
 | | To get more information about this type of hole, read my paper "CRLF Injection", which is available at http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00079.html PERL EXPLOIT: #!/usr/bin/perl -- # Ulf Harnhammar 2002 # example:./exploit www.site1.st www.site2.st # will show www.site2.st die "$0 hostone hosttwo\n" if @ARGV != 2; exec('lynx "'. |
| www.mail-archive.com /bugtraq@securityfocus.com/msg08897.html (448 words) |
|