Bug #64457 [NEW]: HTTP_HOST, SERVER_NAME, SERVER_PORT spoofing

From: dm Operating system: All PHP version: Irrelevant Package: Apache2 related Bug Type: Bug Bug description:HTTP_HOST, SERVER_NAME, SERVER_PORT spoofing Description: ------------ HTTP_HOST is the value from Host header, which can, naturally, be spoofed. On the other hand, SERVER_NAME and SERVER_PORT should reflect real values. I've tested some configurations and on majority you can at least change/spoof SERVER_PORT. This can lead to security issues since these environment variables are often trusted. Test script: --------------- <?php $ch = curl_init('http://smchiptuning.com/http_host.php'); curl_setopt($ch, CURLOPT_HTTPHEADER, array('Host: 127.0.0.1:1337')); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); echo curl_exec($ch); curl_close($ch); /** http_host.php <?php var_dump($_SERVER['SERVER_NAME'], $_SERVER['SERVER_PORT']); */ Expected result: ---------------- string(16) "smchiptuning.com" string(2) "80" Actual result: -------------- string(9) "127.0.0.1" string(4) "1337" -- Edit bug report at https://bugs.php.net/bug.php?id=64457&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=64457&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=64457&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=64457&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=64457&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=64457&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=64457&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=64457&r=needscript Try newer version: https://bugs.php.net/fix.php?id=64457&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=64457&r=support Expected behavior: https://bugs.php.net/fix.php?id=64457&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=64457&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=64457&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=64457&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=64457&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=64457&r=dst IIS Stability: https://bugs.php.net/fix.php?id=64457&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=64457&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=64457&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=64457&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=64457&r=mysqlcfg