Bug #81680 [NEW]: CR-LF injection via "From" field from ini setting

From: ive_jihwan at zerocution dot com Operating system: * PHP version: 8.1.0 Package: *General Issues Bug Type: Bug Bug description:CR-LF injection via "From" field from ini setting Description: ------------ When we set "From" field by setting ini setting "from", which is used for "ftp" and "http" file wrapper, it can inject an arbitrary string in the raw socket message. Since the injected string can contain CR-LF sequence(\r\n), this can be used to interrupt the flow of FTP stream or injecting/smuggling an outgoing HTTP request. I attached an accepted message using netcat in listening mode (nc -l) This is caused by missing checking CNTRLs in both of http_fopen_wrapper.c and ftp_fopen_wrapper.c -- ftp_fopen_wrapper.c:266 -- php_stream_printf(stream, "PASS %s\r\n", FG(from_address)); must be checked using PHP_FTP_CNTRL_CHK before calling printf and -- http_fopen_wrapper.c:550 -- smart_str_appends(&req_buf, FG(from_address)); also must be checked with some logic before appending Test script: --------------- <?php ini_set("from", "Hi\r\nInjected: I HAVE IT"); file_get_contents("http://localhost:3500"); Expected result: ---------------- Should be failed Actual result: -------------- Listening on 0.0.0.0 3500 Connection received on 127.0.0.1 38882 GET / HTTP/1.1 From: Hi Injected: I HAVE IT Host: localhost:3500 Connection: close -- Edit bug report at https://bugs.php.net/bug.php?id=81680&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81680&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81680&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81680&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81680&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81680&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81680&r=support Expected behavior: https://bugs.php.net/fix.php?id=81680&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81680&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81680&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81680&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81680&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81680&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81680&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81680&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81680&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81680&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81680&r=mysqlcfg