#45229 [NEW]: "Insecure" Installation Configuration

From: phpbugs at rjharrison dot org Operating system: *nix PHP version: Irrelevant PHP Bug Type: Documentation problem Bug description: "Insecure" Installation Configuration Description: ------------ The install instructions for *nix + Apache suggest a *potentially* *less secure* configuration of Apache. http://www.php.net/manual/en/install.unix.apache2.php "AddType application/x-httpd-php .php .phtml" The potential vulnerability involves how Apache handles files with multiple extensions. A file named exploit.php.xx.xx will be interpreted as PHP; so if a file was uploaded, a simple check on its extension against a blacklist (.php, .cgi etc) would allow a .php.xx.xx file to pass. Put aside the issue of developer stupidity: instead of the AddType... configuration, we could change it to:- <FilesMatch \.php$> SetHandler application/x-httpd-php </FilesMatch> Which I don't think has any side-effects and means only files with extension .php would be interpreted. Reproduce code: --------------- [Vanilla Apache+PHP installation from source] Filename: exploit.php.xx.xx <?php echo "Oh shit, this ran through PHP!"; ?> When you request http://localhost/exploit.php.xx.xx it will be interpreted by PHP. -- Edit bug report at http://bugs.php.net/?id=45229&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=45229&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=45229&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=45229&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=45229&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=45229&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=45229&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=45229&r=needscript Try newer version: http://bugs.php.net/fix.php?id=45229&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=45229&r=support Expected behavior: http://bugs.php.net/fix.php?id=45229&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=45229&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=45229&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=45229&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=45229&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=45229&r=dst IIS Stability: http://bugs.php.net/fix.php?id=45229&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=45229&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=45229&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=45229&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=45229&r=mysqlcfg