« previous next »
Pages: [1]

Author Topic: Is this a a security hole? What can go wrong?  (Read 2636 times)

buckworks

  • Inner Core
  • Hero Member
  • *
  • Posts: 1634
    • View Profile
Is this a a security hole? What can go wrong?
« on: May 26, 2016, 03:22:06 PM »
I've recently become aware that some sections of a site will generate pages even though the URL is nonsense.

http://www.example.com/this-URL-should-not-exist/ generates a page with the template and some lame default content, and returns 200 OK.

http://www.example.com/any-nonsense-you-can-think-of/ does the same.

I can see how this could become a problem for SEO but are there security implications? What could go wrong?



Logged

Rooftop

  • Inner Core
  • Hero Member
  • *
  • Posts: 1915
    • View Profile
Re: Is this a a security hole? What can go wrong?
« Reply #1 on: May 26, 2016, 04:04:48 PM »
Main problem I see with this is that someone can get pages like example.com/example-dot-com-are-thieves appearing in ther SERPs.  More worrying is when devs take the URL string content and put it on page.

Irish Wonder is the expert on this stuff.  She can probably list another 20 ways to abuse this!
Logged

BoL

  • Inner Core
  • Hero Member
  • *
  • Posts: 1209
    • View Profile
Re: Is this a a security hole? What can go wrong?
« Reply #2 on: May 26, 2016, 04:49:55 PM »
Could be problematic as it's a "soft 404".
Logged

ergophobe

  • Inner Core
  • Hero Member
  • *
  • Posts: 9293
    • View Profile
Re: Is this a a security hole? What can go wrong?
« Reply #3 on: May 26, 2016, 05:26:58 PM »
It should only be a security hole if it is being fed in as an unsantiized SQL query, which I've seen, but that's more and more rare

For example, many CMS (Wordpress, Drupal, etc), handle URLs by rewriting as a query string and passing that to the SQL server.

But that would be a problem whether the page renders or not. In other words, the phenomenon you're seeing might be an indicator that the developer isn't thinking through these issues clearly, but the lack of this issue doesn't indicate your safe and it's presence doesn't indicate an exploit per se.

But devs do all sorts of stupid things. I recently was trying to implement cross-domain tracking between a main site and a third-party site and the third-party site crashes your browser if you had a query string of any sort to the URL. It would be as simple as the dev testing example.com/page?test=anything and it goes into an infinite loop that crashes every browser I've tried - none fail gracefully.
Logged
Pages: [1]
« previous next »