Advertisement




Edit Report

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2015050083

Below is a copy:

phpBB 3.0.13 Open Redirect under chromeSecurity: An insufficient check allowed users of the Google Chrome browser to be redirected to external domains (e.g. on login). Thanks to Mathias Karlsson (avlidienbrunn) for bringing this to our attention.

https://wiki.phpbb.com/Release_Highlights/3.0.14

The patch seems to be this one:
https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04

phpBB/includes/functions.php
 @@ -2492,7 +2492,7 @@ function redirect($url, $return = false, $disable_cd_check = false)
 // Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work)
 if (!$disable_cd_check && $url_parts['host'] !== $user->host)
 {
-$url = generate_board_url();
+trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
 }
 }
 else if ($url[0] == '/')
 @@ -2579,6 +2579,12 @@ function redirect($url, $return = false, $disable_cd_check = false)
 }
 }
 
+// Make sure we don't redirect to external URLs
+if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0)
+{
+trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
+}
+
 // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
 if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
 {

Copyright ©2023 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.