Exploit/Advisories no image

Published on November 22nd, 2022 📆 | 6328 Views ⚑

0

Boa Web Server 0.94.13 / 0.94.14 Authentication Bypass – Torchsec


iSpeech.org

# Exploit Title: Boa Web Server 0.94.13-0.94.14 Authentication Bypass
# Date: 19-11-2022
# Exploit Author: George Tsimpidas
# Vendor: https://github.com/gpg/boa
# CVE: N/A
# Tested on: Debian 5.18.5

Description :

Boa Web Server Versions from 0.94.13 - 0.94.14 fail to validate the
correct security constraint on the HEAD http method allowing everyone
to bypass the Basic Authorization Mechanism.

Culprit :

if (!memcmp(req->logline, "GET ", 4))
req->method = M_GET;
else if (!memcmp(req->logline, "HEAD ", 5))
/* head is just get w/no body */
req->method = M_HEAD;
else if (!memcmp(req->logline, "POST ", 5))
req->method = M_POST;
else {
log_error_doc(req);
fprintf(stderr, "malformed request: \"%s\"\n", req->logline);
send_r_not_implemented(req);
return 0;
}

The req->method = M_HEAD; is being parsed directly on the response.c
file, looking at how the method is being implemented for one of the
response codes :

/* R_NOT_IMP: 505 */
void send_r_bad_version(request * req)
{
SQUASH_KA(req);
req->response_status = R_BAD_VERSION;
if (!req->simple) {
req_write(req, "HTTP/1.0 505 HTTP Version Not Supported\r\n");
print_http_headers(req);
req_write(req, "Content-Type: " HTML "\r\n\r\n"); /* terminate
header */
}
if (req->method != M_HEAD) {
req_write(req,
"505 HTTP Version Not<br />Supported\n"
"

505 HTTP Version Not Supported

\nHTTP
versions "
"other than 0.9 and 1.0 "
"are not supported in Boa.\n

Version encountered: ");
req_write(req, req->http_version);
req_write(req, "

\n");
}
req_flush(req);
}

Above code condition indicates that if (req->method != M_HEAD) therefore
if the the requested method does not equal to M_HEAD then

req_write(req,
"505 HTTP Version Not<br />Supported\n"
"

505 HTTP Version Not Supported

\nHTTP
versions "
"other than 0.9 and 1.0 "
"are not supported in Boa.\n

Version encountered: ");
req_write(req, req->http_version);
req_write(req, "

\n");
}

So if the method actually contains the http method of HEAD it's being
passed for every function that includes all the response code methods.

Source link

Tagged with:



Leave a Reply

Your email address will not be published.