Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Global Redirect 6.x-1.2 Arbitrary Redirection
From: "Justin C. Klein Keane" <justin () madirish net>
Date: Sun, 23 May 2010 08:15:14 -0400

Hash: SHA1

Details of this vulnerability can also be found at:

Description of Vulnerability:
- -----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS)
written in PHP and MySQL.  The Drupal Global Redirect module
(http://drupal.org/project/globalredirect) is designed to address issues
with path aliases in Drupal that could result in user confusion or
search engine sandboxing.  Unfortunately the Global Redirect does not
perform adequate input checking.

Systems affected:
- -----------------
Drupal 6.16 with Global Redirect 6.x-1.2 was tested and shown to be
vulnerable.  According to
(http://drupal.org/project/usage/globalredirect) some 30,000 sites may
be affected by this issue.

- ------
Attackers can provide links to target site that actually redirect users
to third party sites.  Such tactics are common in phishing and other
trust exploitation attacks.  For instance, attackers could provide a
link to a legitimate site in an e-mail that when clicked on would take
the user to an untrusted third party site.

Mitigating factors:
- -------------------
In order to execute the proof of concept described below the attacker
must trick a user into clicking on a link with malicious parameters.

Proof of Concept:
- -----------------
Attackers need only provide a link to the target site appended with
/index.php?q=[target_url].  For instance, if the site in question were, the following link would redirect the
user to the Google.com homepage:

Technical Discussion:
- ---------------------
The drupal_goto function
(http://api.drupal.org/api/function/drupal_goto) normally restricts
redirects to local links utilizing a check on lines 323-327 in
includes/common.inc.  However, the Global Redirect module does not
perform any such checking.  If a redirect request is detected in the
form of a URL get parameter of 'q' when calling the index page the
Global Redirect module forwards the request to the parameter value.

Vendor Response:
- ----------------
In an uncoordinated disclosure, Drupal security decided to handle this
issue publicly at http://drupal.org/node/768244.

- ------
Applying the following patch mitigates this vulnerability:
- --- globalredirect/globalredirect.module        2008-12-22
05:34:32.000000000 -0500
+++ globalredirect.fixed/globalredirect.module  2010-05-21
15:26:08.497695637 -0400
@@ -146,7 +146,12 @@ function globalredirect_init() {
     if ($_REQUEST['q'] != $prefix . $alias) {
       // If it's not just a slash or user has deslash on, redirect
       if (str_replace($prefix . $alias, '', $_REQUEST['q']) != '/' ||
$redirect_slash) {
- -        drupal_goto($alias, $query_string, NULL, 301);
+        // Do not redirect to an absolute URL originating from user input.
+               $colonpos = strpos($request, ':');
+               $absolute = ($colonpos !== FALSE &&
!preg_match('![/?#]!', substr($request, 0, $colonpos)));
+               if (!$absolute) {
+                       drupal_goto($request, $query_string, NULL, 301);
+               }
- -- 
Justin C. Klein Keane

The digital signature on this e-mail can be verified using
the key at http://www.madirish.net/gpgkey
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]