AppWeb Forum

Hi All,

I have located a possible issue - would like you comments (I am referring to appWeb 2.0.5-4):

In:

MprLogToFile::logEvent() , in case there is no actual file descriptor defined (the logging is enabled by compilation, but disabled via conf file), Some errors are logged to the STDERR. for some reason, the following call is made:

======= start code ============

if (logFd < 0 && level <= 1) {
//
// Always output fatal and error messages
//
mprFprintf(MPR_STDERR, buf);
return;
}

// OPT -- could get length above
write(logFd, buf, strlen(buf));

========= end code ==========

the call to mprFprintf, when there is only a buffer, and no other paramaters cause un-expected results, when the 'buf' itself holds some of the special characters, such as : %s, %d ... etc.

for example: if a user initiates a GET request, with a special character, such as:
"GET %n://localhost:80/index.html HTTP/1.1..Host: 172.19.15.11..User-Agent: Security test..Content-Length: 0..Cache-Control: no-cache....\r\n\r\n"
"GET %s%s://localhost:80/index.html HTTP/1.1..Host: 172.19.15.11..User-Agent: Security test..Content-Length: 0..Cache-Control: no-cache....\r\n\r\n"
"GET %d://localhost:80/index.html HTTP/1.1..Host: 172.19.15.11..User-Agent: Security test..Content-Length: 0..Cache-Control: no-cache....\r\n\r\n"

The server cannot find such a page, and tries to write an error message to the stderr. When cheap phentermine passing the above string to the mprFprintf as 'buf', the mprFprintf (or more accurately mprSprintfCore) tries to match the tadalafil %s (or %d or %s) to an argument from the list. However... there is no argument in the list at all - thus resulting in garbage printed in the good case... and segmentation fault in the bad case.

I would like to suggest, changing the call to mprFprintf to be as when writing to a real logfile (and not just STD_ERR), and call write().
I have tested it, it works fine, doesn't harm any of the log options, and secures the web-server from the possible garbage printing or crash.

I would appreciate your comments - as this is a security threat for anyone running the appWeb server.

Thanks,

Nir Rachmel.