matomo-org / component-network Goto Github PK

This was reported by email by a security researcher:

• The getHostname() function in piwik/vendor/piwik/network/src/IP.php does not sanitize the hostname before returning the value.

As described by another security researcher here, http://zoczus.blogspot.sg/2014/05/how-reverse-dns-can-help-us-with-xss.html, an attacker will need to be in control of an IP address where he can set the RDNS hostname to return JS script tags. After that, the attacker tunnels his traffic through that IP address and visits the target site. The getHostname() function will then resolve the IP address and obtain the JS code. Since it is not sanitized, any function which directly stores or displays the hostname will be susceptible to XSS.

The idea is to prevent the function from returning a special string which would trigger an XSS attack, for example <script>alert("1");</script>

Solution

According to RFC1123, valid hostnames can consist of only letters, digits and hyphens. Hence, valid RDNS names should only consist of letter, digits, hyphens and dots. It should thus be possible to sanitize the input to remove all other invalid characters without breaking RDNS resolution for legitimate hosts.

Our solution should also accept international / unicode domains in case the hostname would contain non english characters?

This package could contain IP classes as well as the Url classes from Piwik.

See bug report in matomo-org/matomo#10373

There is nowwhere a function mb_orig_strlen

/**
* Returns true if this is an IPv4, IPv4-compat, or IPv4-mapped address, false otherwise.
*
* @param string $binaryIp
* @return bool
*/
private static function isIPv4($binaryIp)
{
// in case mbstring overloads strlen function
$strlen = function_exists('mb_orig_strlen') ? 'mb_orig_strlen' : 'strlen';

    return $strlen($binaryIp) == 4;
}

Our file headers eg. https://github.com/piwik/component-network/blob/master/src/IPUtils.php can mention LGPL license since we changed from GPL when this component was still in Piwik.