Re: [ml] Header forgiati nelle mail spedite da PHP

Marco Bertorello wrote:
> In pratica, qualcuno riesce a fare una specie di "code-injection" su
> alcuni campi del form e forgiare l'header come vuole, per esempio
> inserendo un bcc con svariati indirizzi email.

una specie di http header injection ma su mail()? e' un problema
applicativo evidentemente, controlla che i campi non contengano
\n o \r e risolvi il problema alla base piuttosto che andare in
cerca di pattern tipo "cc:" o "bcc:"

ad ogni modo il tuo abuse team potrebbe trovare vantaggiosa questa
patch

http://www.lancs.ac.uk/~steveb/php-mail-header-patch
(al momento non va, usate la cache)

riporto da www.phpfreaks.com/articles/1169/0.php
(al momento non va, recuperato dalla cache)

------------------------------------------------------------------------

This patch has been out for awhile apparently, but does not have nearly
enough exposure. It's definately worthy of being merged into the offical
PHP sourcecode.

PHP_Mail_Header_Patch

Motivation

If you have a PHP script that sends mail, the recipient of the mail
message will only see which server it was sent from. There will normally
be no record of who originated the message, or which script on the
server actually caused it to be sent. This can make it difficult to
trace misuse, even if you have comprehensive mail and webserver logs. The

Solution

This patch attempts to address this weakness by inserting an
informational header to messages sent from PHP via the mail() function.
The header identifies both the script and the apparent IP address that
called it. The header added has the form:

X-PHP-Script: [servername][php-self] for [remote-addr]

For example: X-PHP-Script: www.example.com/~user/testapp/send-mail.php
for 10.0.0.1

If the connection appears to have come via a proxy cache (i.e. has an
"X-Forwarded-For" header), is a list of addresses (the addresses in
X-Forwarded-For, then the 'real' remote address).

Good work fellas!

------------------------------------------------------------------------

c'e' un thread anche su php-dev

http://www.lancs.ac.uk/~steveb/php-mail-header-patch

ciao, Francesco 'ascii' Ongaro, http://www.ush.it/