Re: BBCode [IMG] [/IMG] Tag Vulnerability

["Tony Stahler" <TStahler () tempographics com>]

If you wanted to use the script to check it, yet not have to retrieve
the image every time you could have your server download the image
during the post request (assuming it was a reasonable size..) ... check
it, and then have the link be local from that point onward.

This would open more possibilities for exploitation as far as denial of
service attacks though (if your server is downloading it each time, or
if it downloads it once), both for your server and for the server you're
requesting it from.

An example:  I sign up for a bunch of accounts on one forum, or even
multiple forums using this software - then have all the accounts post at
the same time, with multiple images from the same site... the server(s)
then effectively (D)DOS the target server.

It would also work against your server, but in reverse, using a bunch
of accounts (through proxies if necessary) and requesting as many images
from fast servers as possible.. 

You'd probably be better off just deciding which image file types you
consider safe for users... i.e. you probably don't want to allow
flash... and only allow images with those extensions.  Making sure
images are safe isn't really you're responsibility, it's the
responsibility of the image standard, and the browser displaying the
information.  

Just my thoughts,
Tony



> > > Paul Laudanski <zx () castlecops com> 08/22/05 11:12PM >>>
On Mon, 22 Aug 2005, Christopher Kunz wrote:

> Or, you could just disallow remote images altogether. It kinda boils
down to a
> security vs. feature set question...

This is very interesting indeed.  I was originally approaching this 
'problem' from a strictly local host perspective (where the website 
resides) rather than from a remote attack.

You're reply set me straight on that one.

There ought to be a more creative way to monitor this stuff than just 
moving it from GET to POST (and POST in itself is not fool proof).

I'm going to munch on this.

Paul
http://castlecops.com 


________ Information from Computer Cops, L.L.C. ________
This message was checked by NOD32 Antivirus System for Linux Mail
Server.

  part000.txt - is OK
http://castlecops.com