<div dir="ltr">Thank you. Just sent it to <a href="mailto:oss-securty@lists.openwall.com">oss-securty@lists.openwall.com</a>. Happy holidays to you too!<div><br></div><div>Andrey</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 25, 2014 at 7:39 PM, Kurt Seifried <span dir="ltr"><<a href="mailto:kurt@seifried.org" target="_blank">kurt@seifried.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Can you please post this to the oss-security list (<a href="mailto:oss-securty@lists.openwall.com" target="_blank">oss-securty@lists.openwall.com</a>), you don't need to be a member, I can approve the posting. This issue should get a CVE and public announcement as several vendors ship it (I think). Thanks and merry xmas!</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Thu, Dec 25, 2014 at 5:59 PM, isciurus <span dir="ltr"><<a href="mailto:isciurus@gmail.com" target="_blank">isciurus@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><div style="font-size:13px">Hi,</div><div style="font-size:13px"><br></div><div style="font-size:13px">php-openid library treats %0A/%0D characters in hostname of an openid endpoint URL as valid and decodes them into special characters \r\n right before making a discovery request to that location. When it uses curl to make web requests, and I guess this is a recommended way, libcurl passes these invalid URLs to the TCP stream in certain cases, for example, when it is configured to work through proxy. With this discovery logic php-openid allows to craft arbitrary requests inside the org network or to a loopback server interface, which exposes the infrastructure to the outside and is quite bad.</div><div style="font-size:13px"><br></div><div style="font-size:13px">For some reason, hostnames are converted in an unsafe way:</div><div style="font-size:13px"><a href="https://github.com/openid/php-openid/blob/0ef9be71c1ff6114d04bc93d5156c00b25653a1b/Auth/OpenID/URINorm.php#L205" target="_blank">https://github.com/openid/php-openid/blob/0ef9be71c1ff6114d04bc93d5156c00b25653a1b/Auth/OpenID/URINorm.php#L205</a></div><div style="font-size:13px"><br></div><div style="font-size:13px"><div> function Auth_OpenID_pct_encoded_replace($mo)</div><div> {</div><div> return chr(intval($mo[1], 16));</div><div> }</div></div><div style="font-size:13px"> ...</div><div style="font-size:13px"> if (strpos($host, '%') !== -1) {</div><div style="font-size:13px"> $host = strtolower($host);</div><div style="font-size:13px"> $host = preg_replace_callback(</div><div style="font-size:13px"> Auth_OpenID_getEncodedPattern(),</div><div style="font-size:13px"> 'Auth_OpenID_pct_encoded_replace', $host); // <------------</div><div style="font-size:13px"> </div><div style="font-size:13px">..in contrast with path:</div><div style="font-size:13px"> </div><div style="font-size:13px"> function Auth_OpenID_pct_encoded_replace_unreserved($mo)</div><div style="font-size:13px"> {</div><div style="font-size:13px"> $_unreserved = Auth_OpenID_getUnreserved();</div><div style="font-size:13px"> $i = intval($mo[1], 16);</div><div style="font-size:13px"> if ($_unreserved[$i]) {</div><div style="font-size:13px"> return chr($i);</div><div style="font-size:13px"> } else {</div><div style="font-size:13px"> return strtoupper($mo[0]);</div><div style="font-size:13px"> }</div><div style="font-size:13px"> return $mo[0];</div><div style="font-size:13px"> }</div><div style="font-size:13px"> ...</div><div style="font-size:13px"> $path = preg_replace_callback(</div><div style="font-size:13px"> Auth_OpenID_getEncodedPattern(),</div><div style="font-size:13px"> 'Auth_OpenID_pct_encoded_replace_unreserved', $path); // <----------</div><div style="font-size:13px"> </div><div style="font-size:13px"> </div><div style="font-size:13px">Please, have a look at the attached diff, this should resolve the problem.</div><div style="font-size:13px"><br></div><div style="font-size:13px">Thanks,</div><div style="font-size:13px">Andrey Labunets</div></div>
<br></div></div>_______________________________________________<br>
security mailing list<br>
<a href="mailto:security@lists.openid.net" target="_blank">security@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-security" target="_blank">http://lists.openid.net/mailman/listinfo/openid-security</a><br>
<br></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div>Kurt Seifried<br><a href="mailto:kurt@seifried.org" target="_blank">kurt@seifried.org</a></div>
</font></span></div>
</blockquote></div><br></div>