{"id":66,"date":"2005-10-27T07:40:52","date_gmt":"2005-10-27T14:40:52","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2005\/10\/27\/pastebin-rulez\/"},"modified":"2005-10-27T07:40:52","modified_gmt":"2005-10-27T14:40:52","slug":"pastebin-rulez","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2005\/10\/27\/pastebin-rulez\/","title":{"rendered":"pastebin rulez"},"content":{"rendered":"

When discussing code on IRC, I’ve found http:\/\/pastebin.com\/<\/a> to be a valuable resource for sharing code snippets. It has a really simple interface, and can give you a semi-private area just by specifying a subdomain (e.g. http:\/\/yayoutflux<\/strong>.pastebin.com\/<\/a>).<\/p>\n

I had spent some time yesterday doing some other security audits, and figured I’d poke around at pastebin. Overall, the system was fine (only two inputs: text and name — both were strongly filtered). I did discover a redirect bug, though, which would let me use the site to redirect to somewhere else. While there isn’t anything to “steal” on pastebin, a bad guy could still trick their unsuspecting friends into visiting other (maybe more dangerous?) websites.<\/p>\n

I reported the problem to pastebin’s author (Paul Dixon), and he had it fixed before I woke up. That’s<\/em> how vulnerability reporting is supposed to work! Thanks Paul!<\/p>\n

Here’s how it used to work. From the pastebin help<\/a>, you can type in a subdomain to use for your pastebin. (Like “yayoutflux” above.) The form did some checking (no \/’s allowed), but would accidentally let you send whitespace, including a linefeed.<\/p>\n

Normally, a web redirect from that form would look something like this, where the user input is shown in bold:<\/p>\n

\nHTTP\/1.1 302 Found
\nLocation: http:\/\/yayoutflux<\/strong>.pastebin.com\n<\/p><\/blockquote>\n

However, if I add a linefeed (URL encoded as %0A: http:\/\/pastebin.com\/pastebin.php?goprivate=cnn.com%0A<\/strong><\/a>), I could break the “Location” tag, and trick the browser into going somewhere else:<\/p>\n

\nHTTP\/1.1 302 Found
\nLocation: http:\/\/cnn.com<\/strong>
\n.pastebin.com\n<\/p><\/blockquote>\n

Great illustration of redirection XSS.<\/p>\n

© 2005, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

When discussing code on IRC, I’ve found http:\/\/pastebin.com\/ to be a valuable resource for sharing code snippets. It has a really simple interface, and can give you a semi-private area just by specifying a subdomain (e.g. http:\/\/yayoutflux.pastebin.com\/). I had spent some time yesterday doing some other security audits, and figured I’d poke around at pastebin. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,12],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/66"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=66"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/66\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=66"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=66"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=66"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}