Bug #69002 [NEW]: Possible to bypass getimagesize
From: king4aol at gmail dot com
Operating system: Any
PHP version: Irrelevant
Package: GetImageSize related
Bug Type: Bug
Bug description:Possible to bypass getimagesize
Description:
------------
According To Documentation
" The getimagesize() function will determine the size of any given image
file and return the dimensions along with the file type and a
height/width text string to be used inside a normal HTML IMG tag and the
correspondant HTTP content type. "
Many developers just relay on this function while uploading images. As
it is stated that it will also provide content type. And just check
extension at client side. But it is very easy to bypass this function
and execute commands.
Test script:
---------------
For the test purpose i use gifsicle utility for adding comments into a
GIF.
Command
"gifsicle -c '<?php ?>'" anygif.gif > phpgif.gif"
Then while uploading change extension to .php with burpsuite or any
other and you had successfully uploaded your shell. getimagesize won't
check file extension that's why many websites are vulnerable due to some
noob developers and failure of this function.
I am reporting this to you after compromising security of many websites
and i had help them to secure their system.
--
Edit bug report at https://bugs.php.net/bug.php?id=69002&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69002&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69002&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69002&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=69002&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=69002&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=69002&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=69002&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=69002&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=69002&r=support
Expected behavior: https://bugs.php.net/fix.php?id=69002&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=69002&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=69002&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=69002&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69002&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=69002&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=69002&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=69002&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=69002&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=69002&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=69002&r=mysqlcfg
Thread (2 messages)
- king4aol at gmail dot com