wp_redirect() Input Validation Bypass Vulnerability / Filter Bypass Vulnerability

[hakre]

While doing the analysis for #4606 it came to my attention that the input sanitization in wp_redirect() on header values containing %0a and %0d has a flaw. This is fixed by the attached patch. A proof of concept how to bypass %0a and %0d is trivial if you take a look into the changes so I did not publish it. Patch is as always against SVN but this applies to 2.2.2 as well. I have not checked this with older version, they might be affected as well.

Problem

The way wp_redirect() removes %0d and %0a from $location does not work properly.

Solution

It has to be checked for all char-sequences iterativly instead of only one-time per entity.

[hakre]

fix

[markjaquith]

Looks good to me. I tested with nested values like %0%0%0ada and it recursively killed them all.

+1

[markjaquith]

(In [5990]) Better %0d/%0a sanitization for wp_redirect() from hakre. fixes #4819 for trunk

[markjaquith]

(In [5991]) Better %0d/%0a sanitization for wp_redirect() from hakre. fixes #4819 for 2.2.3

[markjaquith]

(In [5992]) Better %0d/%0a sanitization for wp_redirect() from hakre. fixes #4819 for 2.0.12