note 13356 added to security.php
| From: | nycal-assist at tao dot caKILLSPAM | Date: | Wed, 13 Jun 2001 06:09:42 +0000 |
| Subject: | note 13356 added to security.php | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-14434@lists.php.net to get a copy of this message | ||
"Escape Shell" Vulnerability [and How to Avoid It]
Below is an English summary of the French contribution by descript@subakt.fr on 04-Jun-2001 04:36.
Blame mistakes on the translation.
1) INTRO
I know this bug is not new but you still see it a lot.
2) HOW IT WORKS
The use of special characters in a variable which is then used in a shell command (often system).
Example 1
I want to verify a domain name via a web page, I therefore use:
<?
system("whois $domainname");
?>
$domainname is a variable sent to the script by a form. There is a bug in this code, because there
is no filtering of the characters in $domainname. That is to say, if instead of entering
"microsoft.com", I put "yahoo.com;ps%20ax" I would have a list of machine
processes :-). I could just as well put '/bin/sh', 'halt', 'reboot',
'rm -rf /',....
3) SOLUTION
One must filter the characters and authorize only: "abcdefghijklmnopqrstuvwxyz0123456789."
I propose a solution using PHP. Use the below function filter($buffer, 0) to use these characters by
default.
function filter($to_filter, $acceptable_characters) {
if ($acceptable_characters == false) {
$characters = "abcdefghijklmnopqrstuvwxyz0123456789.";
}
else {
$characters = $acceptable_characters;
}
$lower = strtolower($to_filter);
for($d=0; $d<strlen($lower); $d++) {
$strmichael = substr($lower, $d, 1);
$tmp_verif = strstr($caractere, $strmichael);
if ($tmp_verif != "") {
$varverif = true;
}
else {
$varverif = false;
$d = strlen($lower);
}
}
if (!$varverif) {
return(false);
}
else {
return(true);
}
}
4) CONCLUSION
I have written this text for web page languages, but this bug also exists in C/C++, PERL, XALAN,....
Attention: this bug can be even more powerful when the web server is running as root. So be careful
when you program :-)
5)SYSTEM
Linux
xBSD
6) CREDITS
Descript descript@subakt.fr
[This is a summary translation by nycal-assist from the original French]
http://www.php.net/manual/en/security.php