Bug #68851 [NEW]: PHP and Apache2 interpret duplicate Authentication headers differently

From: phillip dot berndt at googlemail dot com Operating system: PHP version: 5.4.36 Package: Apache2 related Bug Type: Bug Bug description:PHP and Apache2 interpret duplicate Authentication headers differently Description: ------------ If a request contains multiple Authorization headers, PHP and Apache parse them differently. If Apache does the authorization, this leads to PHP having a wrong password in $_SERVER[PHP_AUTH_PW]: Apache uses the first header for authentication. PHP concatenates both headers somehow, I suppose with the usual ", " in between, and then messes up base64 decoding (the source code seems to actually call uudecode()?!). This alone does not have any security implications I can think of, therefore I'll categorize this as a simple bug. I haven't looked into the cause of the bug in the base64 decoder though. Test script: --------------- htaccess file: AuthType Basic AuthUserFile /path/to/htpasswd AuthName "test" Require valid-user php script: <?php header("Content-type: text/plain"); echo urlencode($_SERVER["PHP_AUTH_PW"]); htpasswd allows login for user:user Expected result: ---------------- $ curl "http://path/to/page" -H "Authorization: Basic dXNlcjp1c2Vy" -H "Authorization: Basic YWRtaW46YWRtaW4=" user Actual result: -------------- $ curl "http://path/to/page" -H "Authorization: Basic dXNlcjp1c2Vy" -H "Authorization: Basic YWRtaW46YWRtaW4=" user%05%AB%22q%85%91%B5%A5%B8%E9%85%91%B5%A5%B8% -- Edit bug report at https://bugs.php.net/bug.php?id=68851&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68851&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68851&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68851&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68851&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68851&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68851&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68851&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68851&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68851&r=support Expected behavior: https://bugs.php.net/fix.php?id=68851&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68851&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68851&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68851&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68851&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68851&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68851&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68851&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68851&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68851&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68851&r=mysqlcfg