Project

General

Profile

Bug #2646

Log injection vulnerability in mod_auth

Added by stbuehler about 2 years ago. Updated almost 2 years ago.

Status:
Fixed
Priority:
High
Assignee:
-
Category:
-
Target version:
Start date:
2015-05-25
Due date:
% Done:

100%

Missing in 1.5.x:

Description

Reported via mail by Jaanus Kääp (http://jaanuskp.blogspot.de/2015/05/cve-2015-3200.html)

When basic HTTP authentication base64 string does not contain colon character (or contains it after NULL byte - can be inserted inside base64 encoding), then that ituation is logged with a string ": is missing in " and the simply decoded base64 string. This means that new lines, NULL byte and everything else can be encoded with base64 and are then inserted to logs as they are after decoding.

For example header Authorization: Basic dGVzdAAKMjEwMC0wMS0wMSAwMDowMDowMDogKG1hZ2ljLmMuODU5KSBJVCdTIFRIRSBFTkQgT0YgVEhFIFdPUkxEIQ==
results in two log lines:

2015-05-14 12:55:54: (http_auth.c.859) : is missing in test
2100-01-01 00:00:00: (magic.c.859) IT'S THE END OF THE WORLD

Associated revisions

Revision 427120b4 (diff)
Added by stbuehler almost 2 years ago

escape all strings for logging (fixes #2646 log file injection, reported by Jaanus Kääp)

From: Stefan Bühler <>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2989 152afb58-edef-0310-8abb-c4023f1b3aa9

Revision 2989 (diff)
Added by stbuehler almost 2 years ago

escape all strings for logging (fixes #2646 log file injection, reported by Jaanus Kääp)

From: Stefan Bühler <>

History

#1 Updated by petrs almost 2 years ago

Possible fix:

860c860
<               log_error_write(srv, __FILE__, __LINE__, "sb", ": is missing in", username);
---
>               log_error_write(srv, __FILE__, __LINE__, "s", ": is missing in decoded base64-string");

#2 Updated by stbuehler almost 2 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2989.

Also available in: Atom