SA-2008-067 conf_path() header injection vulnerability

we need to validate what characters you expect in the HTTP_HOST

from SA http://drupal.org/node/324824

original report:

From: "Anthony Ferrara"

"
Hello. While at Drupal Camp, I found and confirmed a vulnerability in
Drupal 6 (and 7). Here are the details

In /includes/bootstrap.inc, the function conf_path is defined as such:

function conf_path($require_settings = TRUE, $reset = FALSE) {
static $conf = '';

if ($conf && !$reset) {
return $conf;
}

$confdir = 'sites';
$uri = explode('/', $_SERVER['SCRIPT_NAME'] ?
$_SERVER['SCRIPT_NAME'] : $_SERVER['SCRIPT_FILENAME']);
$server = explode('.', implode('.', array_reverse(explode(':',
rtrim($_SERVER['HTTP_HOST'], '.')))));
for ($i = count($uri) - 1; $i > 0; $i--) {
for ($j = count($server); $j > 0; $j--) {
$dir = implode('.', array_slice($server, -$j)) .
implode('.', array_slice($uri, 0, $i));
if (file_exists("$confdir/$dir/settings.php") ||
(!$require_settings && file_exists("$confdir/$dir"))) {
$conf = "$confdir/$dir";
return $conf;
}
}
}
$conf = "$confdir/default";
return $conf;
}

Notice that it's using both HTTP_HOST and SCRIPT_NAME (and
SCRIPT_FILENAME) are used unvalidated. This provides an injection in
both. Take the following case.

There are 2 Drupal installs on the same server (note, not same
account). The server uses IP based virtual hosts (at least for the
"source" of the attack). As an outsider, all I care, is that the 2
sites are on the same server, and that I can find the absolute path to
the 2nd one (think error messages as a possible source of this
information).

So, at this point I have the following data
Site1: IP 192.168.1.101
Site2: absolute path /home/othersite/public_html

Now, consider the following php code:
$f = fsockopen('192.168.1.101:80');
$headers = 'GET index.php HTTP/1.1
HOST: ../../../../../../../home/othersite/public_html/sites';

Now, since it's IP based virtual hosting, the drupal site is still hit.
The host header ($_SERVER['HTTP_HOST']) now contains the sting
'../../../../../../../home/othersite/public_html/sites';

This line is where the vulnerability is:
$server = explode('.', implode('.', array_reverse(explode(':',
rtrim($_SERVER['HTTP_HOST'], '.')))));

Let's step through the variable at each stage
1: $_SERVER['HTTP_HOST'] =
'../../../../../../../home/othersite/public_html/sites';
2. rtrim(1) = '../../../../../../../home/othersite/public_html/sites';
3. explode(':', 2) =
array('../../../../../../../home/othersite/public_html/sites');
4. implode('.', 3) =
'../../../../../../../home/othersite/public_html/sites';
5. explode('.', 4) = array('', '', '/', '', '', ......
'/home/othersite/public_html/sites');
6. $server = array('', '', '/', '', '', ......
'/home/othersite/public_html/sites');

Next, the function loops over the array, and does a:
$dir = implode('.', array_slice($server, -$j)) . implode('.',
array_slice($uri, 0, $i));

So, what does that first implode do? Simple: restores the previous
path... So if $uri is empty (it happens cause of the clause in the for
($i = count($uri) - 1; $i > 0; $i--) {), the raw path gets ported to
$dir

So at that point, $dir =
'../../../../../../../home/othersite/public_html/sites';

When it hits the piont:
if (file_exists("$confdir/$dir/settings.php") ||
(!$require_settings && file_exists("$confdir/$dir"))) {

remember tha earlier: $confdir = 'sites'

so that first part of the if breaks down to
if(file_exists('sites/../../../../../../../home/othersite/public_html/sites/settings.php'));

remember, that the file DOES exist (because it's site 2)...

So now, I have site1's filebase running on site2's database. Now,
picture site1 is running a module that I can use to inject SQL, or php,
or do bad things, etc...

The fix:
validate what characters you expect in the HTTP_HOST...
So
$host = preg_replace('[^a-z0-9\.-]', '', $_SERVER['HTTP_HOST']);

Here's the patch that was applied to 6.x. But we mght change it to be like what's in install.php