Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: AOL website redirection scripts allow for abuse
From: "morning_wood" <se_cur_ity () hotmail com>
Date: Mon, 27 Dec 2004 17:35:42 -0800

i think there is many like this
http://g.msn.com/0AD00014/?http://google.com
http://g.msn.com/0AD00014/?http://example.com
etc etc etc
your examples actually use an on-site URL redir
and i recall some from yahoo as well used extensivly for spam
im quite sure they ( AOL ) knows about this , and is a purpose
built "feature".

my 2 bits,

m.w

----- Original Message ----- 
From: "Michel Blomgren" <michel.blomgren () tigerteam se>
To: <bugtraq () securityfocus com>; <full-disclosure () lists netsys com>
Sent: Sunday, December 26, 2004 9:43 AM
Subject: [Full-disclosure] AOL website redirection scripts allow for abuse



              tigerteam.se security advisory - TSEAD-200412-1
                              www.tigerteam.se

     Advisory: Hole in AOL's redirection scripts allow for abuse.
         Date: Sat Dec 18 02:29:52 EST 2004
  Application: AOL's "redir", "redir.adp", "clickThruRedirect.adp", and
               "frame.adp" scripts.
Vulnerability: Lack of input filtering allows for redirection abuse.
    Reference: TSEAD-200412-1
       Author: Xavier de Leon <xavier () tigerteam se>


SYNOPSIS

http://www.corp.aol.com/whoweare/mission.shtml


VULNERABILITY

The scripts in question allow input from external resources without
validation  or filtering of any sort. Thus allowing spammers, phishers,
and
other potential attackers a greater deceptive advantage.

On another note, it is widely known that AOL utilizes a rating system
(throttling)  on Instant Messages and e-mails  based on content;
specifically
spam. However, with  the domain prefix aol.com|.* in the mix, rating
doesn't
seem to be quite effective. And that enables spammers and phishers access
to
spread their content around while bypassing certain throttling rates.


COMMENT

In an environment where AOL users are being phished constantly via Instant
Messenger or e-mail, people are being outwitted into giving up sensitive
credentials by clicking on arbitrary links. This is where the stated
vulnerabily steps in.

Although the redirection attacker host can be seen from the url itself, it
can
be easily hex'd. Example:


http://dynamic.aol.com/cgi/redir?http://%77%77%77%2e%74%69%67%65%72%74%65%61%6d%2e%73%65
(redirects to www.tigerteam.se)

[ or http://dynamic.aol.com/cgi/redir?http://tigerteam.se ]

From the example above, one must note that the "http://"; protocol text
must be
included or else the script redirects to "./" (in this case being "/cgi/")

Once redirected, the attacker host will be seen on the address bar.


DISCOVERY

Xavier de Leon <xavier () tigerteam se>

While looking randomly through the AOL pages, I spotted a call to the
'redir'
script.  I entered a bogus url and it redirected without any error
messages
whatsoever.

I searched several search engines (google/vivisimo/yahoo) for pages within
AOL
which made calls to scripts with 'edir' in their name, and ran into the
"clickThruRedirect.adp" and "redir.adp" scripts. It turns out they both
had
the same problem. Upon such results, I began furthur research into the
situation.


EXPLOITATION

http://dynamic.aol.com/cgi/redir?http://www.attacker.com

http://aolsvc.aol.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://content.alerts.aol.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com
http://www.aol.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://sinbad.aol.fr/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://www.shopping.aol.fr/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://ht-brands.aol.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://aolreseau.aol.fr/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://phileas.aol.fr/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://publish.groups.aol.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://shop.aol.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://www.aolatschool.com/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://webcenter.shop.aol.com/ams/clickThruRedirect.adp?0,0,http://www.attacker.com

http://findajob.aol.com/ams/clickThruRedirect.adp?0,0x0,http://attacker.com
http://expressions.aol.com/redir.adp?_dci_url=http://www.attacker.com
http://www.aol.ca/ams/clickThruRedirect.adp?0,0x0,http://attacker.com

http://entertainment.channels.aol.ca/redir.adp?_dci_url=http://www.attacker.com
http://redirect.aol.ca/cgi/redir-complex?sid=0&url=http://www.attacker.com
http://news.channels.aol.ca/redir.adp?_dci_url=http://www.attacker.com
http://travel.channels.aol.ca/redir.adp?_dci_url=http://www.attacker.com

http://www.defidumarche.aol.ca/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://shop.aolcanada.aol.ca/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com
http://finance.channels.aol.ca/redir.adp?_dci_url=http://www.attacker.com
http://women.channels.aol.ca/redir.adp?_dci_url=http://www.attacker.com

http://www.marketchallenge.aol.ca/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com

http://www.aol.com.ar/ams/clickThruRedirect.adp?0,0x0,http://www.attacker.com
http://www.aol.com.ar/frame.adp?url=http://www.attacker.com

Kudos to the AOL Australia team for using their own redirect script:
/cgi-bin/redirector.pl which did a good job only accepting keywords that
are
internally specified and valued to aol.com.au specific urls.


ACKNOWLEDGMENTS

I would like to thank the following people in no particular order:
Michel + all my brothers in p-e and uDc, you know who you are.


ABOUT TIGERTEAM.SE

tigerteam.se offers spearhead competence within the areas of vulnerability
assessment, penetration testing, security implementation, and advanced
ethical
hacking training. tigerteam.se consists of Michel Blomgren - company owner
(M.
Blomgren IT Security) and Xavier de Leon - freelancing IT security
consultant.
Together we have worked for organizations in over 15 countries.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • Re: AOL website redirection scripts allow for abuse morning_wood (Dec 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]