Project

General

Profile

Actions
Copy link

Bug #20913

closed

cHash-checking does not include target page

Added by Ralf Strobel over 15 years ago. Updated about 11 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Caching
Target version:
-
Start date:
2009-08-22
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
4.0
PHP Version:
5.2
Tags:
Complexity:
Is Regression:
No
Sprint Focus:

Description

This issue is potentially dangerous if, for example, you have a website with both a lot of pages and a lot of tt_news entries.

All I need to do is to copy a working parameter combination I can simply get from any news item link. For example "&tx_ttnews[tt_news]=1115&cHash=a6b265ec4d"

Then I submit that query string to all pages on the website. When I tried this, additional cache lines were always generated. So if a website has 1000 news items and 1000 pages (like ours), I could generate 1.000.000 bogus entries. If the webmaster decided to use the backPid and other dynamic parameters, the number of working query combinations I could harvest as an attacker is almost infinite.

I think there should at least be an option to include the page id of the link destination into the generation of the cHash.

(issue imported from #M11767)

Actions
Copy link

Also available in: Atom PDF