1170414 - Redirection loop in *.cgi when path-info is present

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[Santiago]

Look this example:

https://bugzilla.mozilla.org/buglist.cgi/http://google.com

If you execute it in the browser you can see a redirection loop bug, it's making a lot of redirections to the same location and finally finish in the timeout.
An attacker can utilize this vulnerabilitie to flood the victim's traffic.

I tested in other cgi file in the website and all the scripts has the same problem. Another example:

https://bugzilla.mozilla.org/reports.cgi/http://google.com
https://bugzilla.mozilla.org/page.cgi/http://google.com
https://bugzilla.mozilla.org/query.cgi/http://google.com
etc.

Comment 1

[:glob ✱]

this isn't a security issue - it doesn't enable the browser to send any more traffic than is possible with other mechanisms (eg. a request triggered by a javascript interval, or a simple script with a loop).

Comment 2

[:glob ✱]

Attachment: 1170414_1.patch

- tell apache to ignore path-info

Comment 3

[David Lawrence [:dkl]]

Comment on attachment 8613865 [details] [diff] [review]
1170414_1.patch

Review of attachment 8613865 [details] [diff] [review]:
-----------------------------------------------------------------

Breaks REST functionality.

http://localhost/1170414/http://google.com

The requested URL /1170414/http://google.com was not found on this server.

http://localhost/1170414/rest/bug/35

The requested URL /1170414/rest.cgi/bug/35 was not found on this server.

dkl

Comment 4

[:glob ✱]

Attachment: 1170414_2.patch

the crux of the problem is perl's CGI.pm uses $ENV{PATH_INFO} to remove it from the uri:

$uri =~ s/\Q$ENV{PATH_INFO}\E$// if defined $ENV{PATH_INFO};

however apache collapses double slashes to a single slash in env variables, so instead of removing "http://example.com" it tries to remove "http:/example.com" and fails.

Comment 5

[David Lawrence [:dkl]]

Comment on attachment 8614530 [details] [diff] [review]
1170414_2.patch

Review of attachment 8614530 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 6

[:glob ✱]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   f53e220..be25975  master -> master

Comment 7

[Santiago]

Hi,

This issue isn't fix fornow, when i go to https://bugzilla.mozilla.org/reports.cgi/http://google.com is still making the redirections in all scripts.

Comment 8

[David Lawrence [:dkl]]

(In reply to Santiago from comment #7)
> Hi,
> 
> This issue isn't fix fornow, when i go to
> https://bugzilla.mozilla.org/reports.cgi/http://google.com is still making
> the redirections in all scripts.

Sorry. It has been committed to our git repo but it has not yet been pushed out to production. This will likely happen early next week during our normal push time.

dkl

Comment 9

[Mr Hack]

fine, very fast fix. will be able to a bounty?

Regards.

Comment 10

[Santiago]

Sorry, that comment was me, i confuse my accounts

Regards.

Comment 11

[:glob ✱]

(In reply to Mr Hack from comment #9)
> fine, very fast fix. will be able to a bounty?

no - this isn't a security issue.

Comment 12

[Santiago]

It looks like it's fix now!