HTTP Header Injection

Site URL www.travelocity.com

Report generated by Hoyt LLC Research at Fri Oct 22 14:38:42 EDT 2010.

Cross Site Scripting Reports | Hoyt LLC Research

1. HTTP header injection

2. Flash cross-domain policy

3. Password field with autocomplete enabled

4. Cross-domain script include

5. TRACE method is enabled

6. Robots.txt file

7. Cacheable HTTPS response

8. SSL certificate

1. HTTP header injection next

Summary

Severity:	High
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/mystuff/Login.do

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 4d5ed%0d%0a309b8a972b6 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

Request

POST /4d5ed%0d%0a309b8a972b6/Login.do HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: https://travel.travelocity.com/mystuff/MemberLogin.do;jsessionid=3A0D50F3E018267025D36C229D9F0661.p0717?Service=TRAVELOCITY&jsessionid=3A0D50F3E018267025D36C229D9F0661.p0717&target_page=MyAccount
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: travel.travelocity.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: TVLY_GEO=|||||; tyrg1st=61E8641635E69387; SID=T000V00000X301004440050052490098511568; JSID=3A0D50F3E018267025D36C229D9F0661.p0717; Service=TRAVELOCITY; JSESSIONID=3A0D50F3E018267025D36C229D9F0661.p0717
Content-Length: 39

es_alias=&es_passwd=&rememberCookies=on

Response

HTTP/1.1 302 Moved Temporarily
Date: Fri, 22 Oct 2010 06:51:02 GMT
Server: Apache
Location: http://travel.travelocity.com/4d5ed
309b8a972b6/Login.do;jsessionid=3A0D50F3E018267025D36C229D9F0661.p0717?es_passwd=&rememberCookies=on&es_alias=
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 0

2. Flash cross-domain policy previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

Request

GET /crossdomain.xml HTTP/1.0
Host: travel.travelocity.com

Response

HTTP/1.1 200 OK
Date: Fri, 22 Oct 2010 06:41:20 GMT
Server: Apache
Last-Modified: Fri, 26 Feb 2010 16:18:27 GMT
ETag: "77cf2-5d6-3fd77ac0"
Accept-Ranges: bytes
Content-Length: 1494
Vary: Accept-Encoding
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.travelocity.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="www.travelocity.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="i.travelocity.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.travelpn.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="i.travelpn.com.edgesuite.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="i.travelocity.com.edgesuite.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="travelocityf.download.akamai.com.edgesuite.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="ag.travelocity.com.edgesuite.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="hg.travelocity.com.edgesuite.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="design.int.travelocity.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.2mdn.net" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.vulnerable.ad.partner" secure="false"/>
...[SNIP]...
<allow-access-from domain="ad.*.vulnerable.ad.partner" secure="false"/>
...[SNIP]...
<allow-access-from domain="*.aolcdn.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.dotomi.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.sabre.com" secure="false" />
...[SNIP]...
<allow-access-from domain="ach.travel.yahoo.net" secure="false" />
...[SNIP]...

3. Password field with autocomplete enabled previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/mystuff/Login.do

Issue detail

The page contains a form with the following action URL:

https://travel.travelocity.com/mystuff/Login.do

The form contains the following password field with autocomplete enabled:

es_passwd

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

Request

POST /mystuff/Login.do HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: https://travel.travelocity.com/mystuff/MemberLogin.do;jsessionid=3A0D50F3E018267025D36C229D9F0661.p0717?Service=TRAVELOCITY&jsessionid=3A0D50F3E018267025D36C229D9F0661.p0717&target_page=MyAccount
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: travel.travelocity.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: TVLY_GEO=|||||; tyrg1st=61E8641635E69387; SID=T000V00000X301004440050052490098511568; JSID=3A0D50F3E018267025D36C229D9F0661.p0717; Service=TRAVELOCITY; JSESSIONID=3A0D50F3E018267025D36C229D9F0661.p0717
Content-Length: 39

es_alias=&es_passwd=&rememberCookies=on

Response

HTTP/1.1 200 OK
Date: Fri, 22 Oct 2010 06:41:19 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 29842


<script type="text/javascript" src="https://a248.e.akamai.net/f/248/5879/1h/i.travelpn.com/10.10/js/global.js"></script>
<timer:tim
...[SNIP]...
<div id="logform" class="formcontent" style="display: block;">
<form name="LoginForm" action="Login.do" method="post">
<div class="e_box" id="e_box">
...[SNIP]...
</span>
<input type="password" class="formpsw" name="es_passwd" />
</div>
...[SNIP]...

4. Cross-domain script include previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/mystuff/Login.do

Issue detail

The response dynamically includes the following scripts from other domains:

https://a248.e.akamai.net/f/248/5879/1h/i.travelpn.com/10.10/js/global.js
https://a248.e.akamai.net/f/248/5879/1h/i.travelpn.com/10.10/js/navigation.js

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

Request

Response

HTTP/1.1 200 OK
Date: Fri, 22 Oct 2010 06:41:19 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Length: 29842


<script type="text/javascript" src="https://a248.e.akamai.net/f/248/5879/1h/i.travelpn.com/10.10/js/global.js"></script>
<timer:tim
...[SNIP]...
<body id="login" >
<script language="javascript" type="text/javascript" src="https://a248.e.akamai.net/f/248/5879/1h/i.travelpn.com/10.10/js/navigation.js"></script>
...[SNIP]...

5. TRACE method is enabled previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/

Issue description

The TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests which use the TRACE method by echoing in its response the exact request which was received.

Although this behaviour is apparently harmless in itself, it can sometimes be leveraged to support attacks against other application users. If an attacker can find a way of causing a user to make a TRACE request, and can retrieve the response to that request, then the attacker will be able to capture any sensitive data which is included in the request by the user's browser, for example session cookies or credentials for platform-level authentication. This may exacerbate the impact of other vulnerabilities, such as cross-site scripting.

Issue remediation

The TRACE method should be disabled on the web server.

Request

TRACE / HTTP/1.0
Host: travel.travelocity.com
Cookie: 5d56f156a767850d

Response

HTTP/1.1 200 OK
Date: Fri, 22 Oct 2010 06:41:20 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: travel.travelocity.com
Cookie: 5d56f156a767850d
X-Forwarded-For: 204.51.113.169

6. Robots.txt file previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/mystuff/Login.do

Issue detail

The web server contains a robots.txt file.

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

Request

GET /robots.txt HTTP/1.0
Host: travel.travelocity.com

Response

HTTP/1.1 200 OK
Date: Fri, 22 Oct 2010 06:41:22 GMT
Server: Apache
Last-Modified: Fri, 30 Oct 2009 13:04:04 GMT
ETag: "16adb7-cb-a98e9900"
Accept-Ranges: bytes
Content-Length: 203
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=ISO-8859-1

User-agent: *
Disallow:
Sitemap: http://travel.travelocity.com/cruise_sitemap.xml
Sitemap: http://hotels.travelocity.com/sitemap.xml
Sitemap: http://hotels.travelocity.com/sitemapindexhoteldetails.xml
...[SNIP]...

7. Cacheable HTTPS response previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/mystuff/Login.do

Issue description

Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Issue remediation

The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store
Pragma: no-cache

Request

Response

8. SSL certificate previous

Summary

Severity:	Information
Confidence:	Certain
Host:	https://travel.travelocity.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	travel.travelocity.com
Issued by:	VeriSign Class 3 Extended Validation SSL SGC CA
Valid from:	Thu Jan 28 19:00:00 EST 2010
Valid to:	Sun Jan 29 18:59:59 EST 2012

Certificate chain #1

Issued to:	VeriSign Class 3 Extended Validation SSL SGC CA
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Tue Nov 07 19:00:00 EST 2006
Valid to:	Mon Nov 07 18:59:59 EST 2016

Certificate chain #2

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Tue Nov 07 19:00:00 EST 2006
Valid to:	Sun Nov 07 18:59:59 EST 2021

Certificate chain #3

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 19:00:00 EST 1996
Valid to:	Wed Aug 02 19:59:59 EDT 2028

Issue background

SSL helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an SSL certificate which is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, SSL connections to the server will not provide the full protection for which SSL is designed.

It should be noted that various attacks exist against SSL in general, and in the context of HTTPS web connections. It may be possible for a determined and suitably-positioned attacker to compromise SSL connections without user detection even when a valid SSL certificate is used.

Report generated by Hoyt LLC Research at Fri Oct 22 14:38:42 EDT 2010.

HTTP Header Injection

Site URL www.travelocity.com

Cross Site Scripting Reports | Hoyt LLC Research

Contents

Summary

Issue detail

Issue background

Issue remediation

Request

Response

Summary

Issue detail

Issue background

Issue remediation

Request

Response

Summary

Issue detail

Issue background

Issue remediation

Request

Response

Summary

Issue detail

Issue background

Issue remediation

Request

Response

Summary

Issue description

Issue remediation

Request

Response

Summary

Issue detail

Issue background

Issue remediation

Request

Response

Summary

Issue description

Issue remediation

Request

Response

Summary

Issue detail

Server certificate

Certificate chain #1

Certificate chain #2

Certificate chain #3

Issue background