WebWasher Classic - HTTP CONNECT weakness

2005-01-30T00:00:00
ID SECURITYVULNS:DOC:7708
Type securityvulns
Reporter Securityvulns
Modified 2005-01-30T00:00:00

Description

WebWasher Classic - HTTP CONNECT weakness

WebWasher Classic

WebWasher Classic is a well known HTTP-URL/Popup/Script filtering proxy which is free for non commercial use. WebWasher Classic supports two modes, a client mode, where it only works for the local machine (bound to localhost) and a server mode, where it serves as a network proxy (bound to 0.0.0.0).

Weakness

If running in server mode, it is possible to connect from remote to tcp ports listening on 127.0.0.1 of the WebWasher system. This is an design flaw, because CONNECT requests to localhost should be denied. It also may be possible to bypass accesslists of firewalls, protecting the WebWasher system.

Version

WebWasher Classic v3.3 and v.2.2.1 on Windows platform. Other platforms were not tested, but may also be affected.

Exploiting/PoC

1) Start a netcat listener on the WebWasher system: netcat -L -p 99 -s 127.0.0.1 < hallo.txt 2) Connect to the WebWasher proxy port (default 8080/tcp) 3) Enter command "CONNECT 127.0.0.1:99 HTTP/1.0"

As a result, content of hallo.txt will appear.

Vendor:

http://www.webwasher.com (Webwasher belongs to CyberGuard)

Discovered

by oliver karow http://www.oliverkarow.de/research/WebWasherCONNECT.txt

-- Sparen beginnt mit GMX DSL: http://www.gmx.net/de/go/dsl