Re: Is this exploitable?..

[Stephen de Vries <stephen () twisteddelight org>]

Hi Ben

Yes it is exploitable, one attack vector is called Cross Site Tracing 
documented here: 
http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf

It should be noted that this is not a vulnerability in the J2EE 
implementation of TRACE, it is a problem with the TRACE method itself, 
see the HTTP 1.1 RFC for more info: 
http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.8

Regards,
Stephen



On Dec 15, 2004, at 10:42 PM, Benjamin Livshits wrote:

> I was looking at the follong code in J2EE 1.4.1 HttpServlet.java and it
> looks like it may be possible to exploit it:
>
>     672     protected void doTrace(HttpServletRequest req,
> HttpServletResponse resp)
>     673         throws ServletException, IOException
>     674     {
>     675
>     676         int responseLength;
>     677
>     678         String CRLF = "\r\n";
>     679         String responseString = "TRACE "+ req.getRequestURI()+
>     680             " " + req.getProtocol();
>     681
>     682         Enumeration reqHeaderEnum = req.getHeaderNames();
>     683
>     684         while( reqHeaderEnum.hasMoreElements() ) {
>     685             String headerName =
> (String)reqHeaderEnum.nextElement();
>     686             responseString += CRLF + headerName + ": " +
>     687                 req.getHeader(headerName);
>     688         }
>     689
>     690         responseString += CRLF;
>     691
>     692         responseLength = responseString.length();
>     693
>     694         resp.setContentType("message/http");
>     695         resp.setContentLength(responseLength);
>     696         ServletOutputStream out = resp.getOutputStream();
>     697         out.print(responseString);
>     698         out.close();
>     699         return;
>     700     }
>
> It looks like responseString obtained from req is forgeable and this 
> may
> conceivably lead to a vulnerability down the line, it seems, when
> responseString is output with a call to out.print(responseString).
>
> Please advise.
>
> -Ben