Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #7806 HTTP Response Splitting and uncontroled redirection in FRS module
    Actions
    Infos
    #7806
    Thomas Gerbet (tgerbet)
    2015-03-04 16:22
    2015-01-28 17:05
    7808
    Details
    HTTP Response Splitting and uncontroled redirection in FRS module

    The parameter filename of the page /file/confirm_download.php could be exploited to create a HTTP response splitting or to force an user to do an unwanted action.

    Impact

    An attacker could use this vulnerability to force a victim to execute uncontrolled code or to do unwanted action.
    CVSS2 score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

    Exploitation

    HTTP Response Splitting: <tuleap_url>/file/confirm_download.php?popup=1&group_id=XXX&file_id=X&filename=name<CRLF><Attacker HTTP Request>
    Uncontroled redirection: <tuleap_url>/file/confirm_download.php?group_id=XXX&file_id=X&filename=../../../../../account/logout.php

    References

    https://cwe.mitre.org/data/definitions/113.html
    https://www.owasp.org/index.php/HTTP_Response_Splitting

    Delivery/File release system
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2015-03-02
    Attachments
    Artifact links
    Empty
    Empty
    References
    Referencing request #7806

    Artifact Tracker v5

    rel #7843 7.11

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/68/3568/1' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD f62b6ba3f8
    User avatar Yannis ROSSETTO (rossettoy) , 2015-01-29 16:54
    request #7806: Avoid HTTP Response Splitting and uncontroled redirection in FRS f8d1d4b673
    User avatar Thomas Gerbet (tgerbet) , 2015-01-28 17:36
    This is Tuleap 7.9.99.75 456fe93955
    User avatar Yannis ROSSETTO (rossettoy) , 2015-01-29 17:08
    Merge commit 'refs/changes/37/3637/1' of ssh://gerrit.tuleap.net:29418/tuleap into tuleap-stable-master 71f3668c19
    User avatar Manuel Vacelet (vaceletm) , 2015-03-02 13:39
    request #7806: Avoid HTTP Response Splitting and uncontroled redirection in FRS ad0338029d
    User avatar Thomas Gerbet (tgerbet) , 2015-02-16 14:27
    request #7806: Avoid HTTP Response Splitting and uncontroled redirection in FRS 2bc9862e87
    User avatar Thomas Gerbet (tgerbet) , 2015-02-24 14:23
    Referenced by request #7806

    Other

    gerrit #3568
    gerrit #3637
    Display settings

    Follow-ups

    User avatar
    Yannis ROSSETTO (rossettoy)2015-01-29 16:55
    Merged in Tuleap 7.9.99.74
    • Status changed from Under review to Closed
    • Close date set to 2015-01-29