Project

General

Profile

Actions
Copy link

Bug #58816

closed

Response Splitting Vulnerability

Added by Sven Carstens almost 10 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Must have
Assignee:
-
Category:
-
Target version:
-
Start date:
2014-05-15
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
4.7
PHP Version:
Tags:
Complexity:
Is Regression:
No
Sprint Focus:

Description

TYPO3 4.7.18 is vulnerable to Response Splitting (http://en.wikipedia.org/wiki/HTTP_response_splitting)

A recent security audit on our installed customer systems discovered a Response Splitting vulnerability that can be triggered via the redirect_url paramater used by the felogin extension.

The request:
curl -i http://localhost/ --data 'logintype=login&pass=g00dPa%24%24w0rD&pid=0&redirect_url=%0d%0aSomeCustomInjectedHeader:injected&submit=Anmelden&tx_felogin_pi1%5bnoredirect%5d=0&user=wwibephd'

The Response headers:
---------------------
HTTP/1.1 303 See Other
Date: Wed, 14 May 2014 14:06:25 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.11
Location: http://localhost/
SomeCustomInjectedHeader:injected
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html
---------------------

This issue should be fixed in the redirect utility method inside of class.t3lib_utility_http.php inside of the function redirect Line 96.
- header('Location: ' . t3lib_div::locationHeaderUrl($url));
+ header('Location: ' . rawurlencode(t3lib_div::locationHeaderUrl($url)));

The fix should be ported to the other TYPO3 version that are currently supported.

Related issues 2 (0 open — 2 closed)

Related to TYPO3 Core - Task #58850: Redirect URLs containing special chars may lead to garbled headersClosed2014-05-16

Actions
Related to TYPO3 Core - Task #73700: Remove security fix for #58816 as of PHP7ClosedAlexander Opitz2016-02-26

Actions
Actions
Copy link

Also available in: Atom PDF