RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c

From: James Cox [mailto:james@blog.at] > because the only way apache would allow php to work was via an Action > redirect, and that had to be accessible in the docroot, it was possible to > go to www.example.com/php/php.exe?c:\winnt\repair\sam (for example) and see > sensitive data. > > now we just deny all direct requests to the cli in that scenario. Listed the captured the _SERVER values from Apache and IIS below. I could not find a way to exercise the exploit under IIS Edited out the uninteresting values. _SERVER argc [Apache - ok] = 0 _SERVER argc [Apache - bad] = 1 _SERVER argc [IIS 4.0 - ok] = 0 _SERVER argc [IIS 5.0 - ok] = 0 _SERVER HTTP_REFERER [IIS 4.0 - ok] = http://gerald/php/ _SERVER HTTP_REFERER [IIS 5.0 - ok] = http://localhost/php/ _SERVER PATH_INFO [Apache - ok] = /php/env.php _SERVER PATH_INFO [IIS 4.0 - ok] = /php/env.php _SERVER PATH_INFO [IIS 5.0 - ok] = /php/env.php _SERVER PATH_TRANSLATED [Apache - ok] = c:\\inetpub\\wwwroot\\php\\env.php _SERVER PATH_TRANSLATED [IIS 4.0 - ok] = c:\\inetpub\\wwwroot\\php\\env.php _SERVER PATH_TRANSLATED [IIS 5.0 - ok] = c:\\inetpub\\wwwroot\\php\\env.php _SERVER REDIRECT_STATUS [Apache - ok] = 200 _SERVER REDIRECT_URL [Apache - ok] = /php/env.php _SERVER REQUEST_URI [Apache - ok] = /php/env.php _SERVER REQUEST_URI [Apache - bad] = /xxx/php?c:\\inetpub\\wwwroot\\php\\env.php _SERVER SERVER_SOFTWARE [Apache - ok] = Apache/1.3.24 (Win32) _SERVER SERVER_SOFTWARE [Apache - bad] = Apache/1.3.24 (Win32) _SERVER SERVER_SOFTWARE [IIS 4.0 - ok] = Microsoft-IIS/4.0 _SERVER SERVER_SOFTWARE [IIS 5.0 - ok] = Microsoft-IIS/5.0 IIS/4.0 is in fact PWS installed on Win98 second edition with no updates applied. IIS/5.0 is on Windows 2000 with all updates. This should be a more than sufficient range to test as with anything older you've got worse problems than with PHP :). Values present only in the good cases: HTTP_REFERER - IIS only, can be faked by "Referer:" request header? PATH_INFO - Apache or IIS PATH_TRANSLATED - Apache or IIS REDIRECT_STATUS - Apache only REDIRECT_URL - Apache only Specific recognizable values for the good cases: SERVER_SOFTWARE - match /^Microsoft-IIS/ and exploit does not apply. Specific recognizable values for the bad cases: argc = 1 - although counting on this seems at least dubious. Checking PATH_INFO and PATH_TRANSLATED would work for either Apache or IIS, but it is not clear to me *why* this is so.