Sagewire Logo

vulnerability ?

4 Message(s) by 2 Author(s) originally posted in php language


From: Peter Date:   Saturday, September 29, 2007
Hi,

Sorry for the long intro but I think I should mention this first:

My site is driven by Smarty, a php based framework.
One of the features of Smarty is that after dynamically building a page, it
can be cache d and re-used always after it has been compiled once.

One day a found a file *.txt? on my webspace and go very worried ... how did
it get there ... so I did some searching and read about a problem with file
insertion in combination with register_globals = on.
I have re-written my (none-smarty) php scripts to not need register_globals
and since a while now register_globals = off
(PS. I have asked my site-admin to re-check this setting while I'm writing
this)

I haven't found rogue files since BUT I notice from time to time that link s
in my pages have changed. This is after I updated pages and cleared the
cache, so that all pages needed to be rebuild. As pages are built on a need
only basis, some of the lesser used pages get built days after and aren't
checked by me. Once built they get cached, and used always, but some thugs
or whatever, manage to make the system cache badly built pages (with changed
links).

To the point:

The changed links in question are always to the "same" page but in another
folder (different language).
The created page link is then something like '/es/' . $from
Where $from is created as follows:

$link =
explode('/',$_SERVER['PHP_SELF'].$special_char.$_SERVER['QUERY_STRING']);
$from = $link[sizeof($link)-1];

This is code written by the original site designer and I'm not good enough
to figure this one out but I think the clue lies here ?
I think the "hooligans" are creating URL s such that the created $from
variable isn't what it is supposed to be.

E.g. on page1.php
a link should be created that points to /es/page1.php
but sometimes I find that the link is /es/pb.txt?
or another *.txt? variant.

If you know what's going on please let me know. I'd love to understand the
details of it.
And secondly, probably more important, how to fix it.

Thanks
Peter


From: Peter Date:   Saturday, September 29, 2007
Addionally,

I figure this piece of code needs to be mentioned as well (placed before the
earlier mentioned code) :

if($_SERVER['QUERY_STRING']!="")
$special_char='?';
else $special_char="";

Followed by earlier mentioned piece of code:

$link =
explode('/',$_SERVER['PHP_SELF'].$special_char.$_SERVER['QUERY_STRING']);
$from = $link[sizeof($link)-1];

Further investigating also shows (not hundred % sure, but it looks like it)
that the problem only occurs on pages where parameters can be passed.

e.g. page1?item=1
etc.


From: Peter Date:   Saturday, September 29, 2007
I think I got it.
They simply need to add a slash in the URL and then a file of their choice.
The last array member is then the added file and that ends up in $from


From: Ian Hobson Date:   Saturday, September 29, 2007
wrote in message:
Addionally,
I figure this piece of code needs to be mentioned as well (placed before the
earlier mentioned code) :
if($_SERVER['QUERY_STRING']!="")
$special_char='?';
else $special_char="";
Followed by earlier mentioned piece of code:
$link =
explode('/',$_SERVER['PHP_SELF'].$special_char.$_SERVER['QUERY_STRING']);
$from = $link[sizeof($link)-1];
Further investigating also shows (not hundred % sure, but it looks like it)
that the problem only occurs on pages where parameters can be passed.
e.g. page1?item=1
etc.


Your problem is that $_SERVER['QUERY_STRING']); comes from the
user/script kiddie, and isn't to be trusted. It is used unchecked.
The code needs to test it very carefully to stop what are called
injection attacks.

Your code works on the path the visitor typed - lets say it was
http://domain.com/path/path2/file.php?parm=value#param2=anothervalue

The first part reassembles the
"path/path2/file.php?parm=value#param2=anothervalue" part. If there is
no query string , it get just "path/path2/file.php".

Then explode, splits this into pieces at every "/".

And the last line takes the last entry - here
"file.php?parm=value#param2=anothervalue" (or just file.php).

But if the user typed a / in the value of param2 things go strange.

path/path2/file.php?parm=value#param2=an/injectionattack.php" will
result in the value of $link being "injectionattack.php".

I'd let the interpreter parse the query string into the $_POST or
$_GET variable, and then take just the parameters expected
($_GET['parm'] and $_GET['param2']) and test those have sane values. For
example, contain only letters.

However, do not worry over much about injection attacks creating (bad?)
links to files on your web site - those will be served if the user
simply types their name anyway. What is much more dangerous is when the
data is sent to a database as part of a query.

Hope that helps.

Ian



Next Message: Does PDFLIB Lite require a license?


Blogs related to vulnerability ?

Re: developing a php vulnerability scanner, help!
CROSS POSTED http://forum.java.sun.com/thread.jspa?threadID=5204748.

CVE-2007-5115
Multiple PHP remote file inclusion vulnerabilities in Ekke Doerre Contenido 42VariablVersion (42VV10) in contenido_hacks in Mods 4 Xoops Contenido eZ publish (pdf4cms) allow remote attackers to execute arbitrary PHP code via a URL in ...

developing a php vulnerability scanner, help!
I want to develop a php vulnerability scanner exploiting malicious input and API abuse, but I don't know where to start. Any idea on any book or paper I should read about developing a vulnerability scanner and building a compiler? ...

Vuln: NukeSentinel NSBypass.PHP SQL Injection Vulnerability
PHP SQL Injection Vulnerability >> Advertisement << ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper Blind SQL Injection can deliver total control of your server to a hacker giving them the ...

CVE-2007-5139
PHP remote file inclusion vulnerability in admin/include/header.php in chupix 0.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter.

CVE-2007-5138
PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the view parameter.


Programming | Sports | Autos

copyright 2006
Valid XHTML 1.0 Transitional