Sec Bug->Bug #75840 [Fbk]: when i load COM('WScript.shell') and call exec('cmd.exe /c whoami') to execute

Edit report at https://bugs.php.net/bug.php?id=75840&edit=1 ID: 75840 Updated by: stas@php.net Reported by: zhang_xiaobao at venustech dot com dot cn Summary: when i load COM('WScript.shell') and call exec('cmd.exe /c whoami') to execute Status: Feedback -Type: Security +Type: Bug Package: COM related Operating System: windows PHP Version: 7.0.27 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2018-01-20 19:29:38] ab@php.net Thanks for the report. I currently don't reproduce any crash with your code. Could you please provide a corresponding backtrace and/or crash dump? Modules are only freed at the process exit, mpm_winnt is only one child per server. Is that about mpm_winnt or fcgi? Disregarding the possible crash, I'd not see this as a security issue. Thanks. ------------------------------------------------------------------------ [2018-01-18 09:10:56] zhang_xiaobao at venustech dot com dot cn Description: ------------ <?php $wsh = new COM('WScript.shell'); $exec = $wsh->exec('cmd.exe /c whoami'); $stdout = $exec->StdOut(); $stroutput = $stdout->ReadAll(); echo $stroutput; ?> Test script: --------------- <?php $wsh = new COM('WScript.shell'); $exec = $wsh->exec('cmd.exe /c whoami'); $stdout = $exec->StdOut(); $stroutput = $stdout->ReadAll(); echo $stroutput; ?> Expected result: ---------------- 1. First of all, add extension=php_com_dotnet.dll in php.ini. 2. when i load COM('WScript.shell') and call exec('cmd.exe /c whoami') to execute system command,the inside of the com waits for the process to exit, as the same time,the com is freed by other modules,when the cmd.exe exited, the thread who suspend with the waitformultipleobjects function is activated. but the eip is not invalid,because of the memory is free. Actual result: -------------- It cause the process of httpd.exe to crash. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75840&edit=1