If this PHP bug or Web server bug?

sulaiman

to recreate the problem

create ta.php in your web folder.
with the content below

ta.php

sulaiman · 2003-12-26T09:39:59+00:00

to recreate the problem create ta.php in your web folder. with the content below ta.php <img src="tb.php"> create tb.php in your web folder. with th...

create tb.php in your web folder.
with the content below.

tb.php

<?php
$a = fopen('apple.txt', 'wb');
fwrite($a, 'testing');
fclose($a);
?>

if you see apple.txt created after viewing the ta.php file running through web server.

then

Make sure, if u enable file upload in your application. CHECK THE UPLOADED FILE EXTENSION

AFFECTED SERVER OR PHP VERSION
OmniHTTPD 2.x 4.3.4
Apache (possible, please try and reply back)

sulaiman

if Apache prove to be affected by this kinda tricks... then all the open source web application out there (who didn't check for uploaded file extension)... will be a big risk

planetsim

may i ask why do we need to recreate the problem. Can you just explain what is happening are you recieving an error, is the file not being created?

Most servers are set up differently to be honest you will not get the same result you did

swr

What are you getting at?

As far as I can tell the ta.php step is not needed. It's just an img tag, which will cause your browser to request tb.php, which will invoke the tb.php code. You should be able to just point your browser at tb.php and get the same result.

tb.php creates a file, so naturally it will exist, if your PHP script has permission to write files.

Are you concerned that users might use a PHP file upload form to upload a file with a .php extension containing nasty code? That is a concern, and you should always be extra careful about what files you let users create. But I'm not understanding what your ta.php and tb.php is trying to demonstrate?

Weedpacket

I don't see the significance of this either - what does this have to do with uploading files? All it does is open a file and write to it.

Besides, when you upload a file you ought to do more than just "check the extension" before you do anything potentially risky with it - you have to check the file itself, because the extension could be anything - as all those people who use Outlook should know.

Lahloob

I don't believe it's Apache's responsibility, I think it's the programmer's.

He should limit extensions using whatever methodology he can come up with.

I can tell one thing, free hosting servers that support php (like Lycos) ..surely have enough security considerations that allow uploading these scripting files with no concern. I just wonder how can uploading these files be safe in such hosting servers.

sulaiman

so, the major concern is,
if i know the server site contained a file named bug.php
what i have to do is to upload a test.html(not a scripting file also can) file that contained html image tag source to bug.php and bug.php file will get executed.

the thing is, in the above situation, in an ideal way, bug.php should not get executed.

sulaiman

another way to run the php bug.php script is

let say some Open source web application that provide for user
a textarea to write something

so , user just need to locate the bug.php
and <img src=bug.php> thats all. bug.php will get executed.

swr

Originally posted by sulaiman
so , user just need to locate the bug.php
and <img src=bug.php> thats all. bug.php will get executed.

It would only be executed if the person could also execute it by typing bug.php into the location bar of their browser. Using an img tag is just another way of causing the web browser to request a file from the server. It's the same thing as far as the server is concerned.

If you don't want users to be able to execute bug.php, then don't put it in a web-accessible directory.

sulaiman

we can change the order of the loaded file...

assume an open source web application,

the order of include file is

1.php
2.php <html output started here>
3.php
4.php <authentication file>
5.php <loading end here>

so, if we able to corrupt the loading sequence
example by using the <img src="5.php"> tag.

perhaps the application will crash... for not including 4.php and 5.php