Bug #60668 [Com]: Setting user_agent can send other headers
Edit report at https://bugs.php.net/bug.php?id=60668&edit=1
ID: 60668
Comment by: me at ktamura dot com
Reported by: vrana@php.net
Summary: Setting user_agent can send other headers
Status: Open
Type: Bug
Package: HTTP related
Operating System: Irrelevant
PHP Version: 5.4.0RC5
Block user comment: N
Private report: N
New Comment:
vrana: I think this is a pretty bad security issue. Here is a proposed diff as a
github gist: https://gist.github.com/1675788
Previous Comments:
------------------------------------------------------------------------
[2012-01-06 10:08:41] vrana@php.net
Description:
------------
Setting 'user_agent' INI value to a string containing a newline causes sending a new
header. This behavior is even documented: http://php.net/wrappers.http#wrappers.http.example.custom.headers
It is wrong for two reasons:
1. 'user_agent' INI setting should be used only for setting a User-Agent header and not
for anything else.
2. It is a potential security risk (header injection) similar to the one fixed in PHP 5.1.2 (but
with low impact).
(See also bug #52979 but I believe that I am providing a better reasoning.)
Test script:
---------------
<?php
$_POST['user_agent'] = "Robot\r\nX-Command: delete-all";
ini_set('user_agent', $_POST['user_agent']);
readfile('http://private/service.php');
?>
Expected result:
----------------
Sending just a User-Agent header, not X-Command header.
Actual result:
--------------
Sending User-Agent and X-Command headers.
If http://private/service.php accepts connections only from
trusted sources and parses its commands from headers then it will execute the malicious action.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=60668&edit=1
Thread (4 messages)