Bug #81339 [NEW]: PHP source code exposed on Windows

From: phith0n dot ph2f at gmail dot com Operating system: Windows PHP version: 8.0.9 Package: Built-in web server Bug Type: Bug Bug description:PHP source code exposed on Windows Description: ------------ I am using the PHP built-in server as the development web server on Windows. Recently I found a bug, sometimes a vulnerability, which is able to expose the PHP scripts' source code in the web folder. NTFS stream is supported on Windows, reference to this document: <https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3>. So use info.php::$DATA to open and read the file info.php is valid, which is bypass the extension dispatch in built-in web server: ```c if (client->request.ext_len != 3 || (ext[0] != 'p' && ext[0] != 'P') || (ext[1] != 'h' && ext[1] != 'H') || (ext[2] != 'p' && ext[2] != 'P') || !client->request.path_translated) { is_static_file = 1; } ``` Some related bugs are: - https://bugs.php.net/77932 - https://bugs.php.net/71559 Test script: --------------- Run PHP built-in server on Windows NTFS filesystem: ``` php -S localhost:9090 ``` Put a PHP script info.php in the web folder: ``` <?php phpinfo(); ``` Browse the http://localhost:9090/info.php::$DATA` from browser or CURL. Expected result: ---------------- A "404 not found" error is raised. Actual result: -------------- Source code of info.php is exposed: <https://imgur.com/G9tBTHy> -- Edit bug report at https://bugs.php.net/bug.php?id=81339&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81339&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81339&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81339&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81339&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81339&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81339&r=support Expected behavior: https://bugs.php.net/fix.php?id=81339&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81339&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81339&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81339&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81339&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81339&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81339&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81339&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81339&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81339&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81339&r=mysqlcfg