Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Kevin Johnson BASE <= 1.3.6 authentication bypass
From: "Jamie Riden" <jamie.riden () gmail com>
Date: Wed, 6 Jun 2007 11:04:27 +0100

On 04/06/07, Johnny Storm <johnny653 () gmail com> wrote:
Basic Analysis and Security Engine (BASE)
(http://base.secureideas.net/)


One more security product with lame bugs...

Let's look at Kevin's authentication code,
for example in base_main.php (all pages vulnerable):

 [...]
 64   // Check role out and redirect if needed -- Kevin
  65   $roleneeded = 10000;
  66   $BUser = new BaseUser();
  67   //if (($Use_Auth_System == 1) && ($BUser->hasRole($roleneeded) == 0))
 68   if ($Use_Auth_System == 1)
 69   {
  70       if ($BUser->hasRole($roleneeded) == 0)
 71       {
  72           header("Location: $BASE_urlpath/index.php");
 73       }
 74   }
 [...]

Where is bug?
Yes, your browser will redirect after received location header,
but what if not? ;-)

[carefully ignoring the rest of the thread...]

Yes, I believe it's good practice to exit(); after a header('Location:
...') - I've certainly tried to make all my code do it as far as
possible. See for example:

"Special attention should be paid when using Location header, however,
as it is used to redirect clients from one page to another. When you
send a Location header, PHP will continue to parse the script after
the header was issued, which wastes system resources and also may let
people see pages they would otherwise not be able to see. As a result,
it's best to use call "exit;" immediately after header("Location:
...") to make sure that nothing happens after the redirect notice has
been sent."  --
http://www.hudzilla.org/phpwiki/index.php?title=Sending_custom_HTTP_headers

That's all I'm saying, as I don't know the code well enough to guess
the security implications and I don't have a running system to test on
right now.

cheers,
 Jamie
-- 
Jamie Riden, CISSP / jamesr () europe com / jamie () honeynet org uk
UK Honeynet Project: http://www.ukhoneynet.org/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]