Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59471
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYQ0r9mr7AfQZyN8iVzDXV2rca_eK=ZWgtt2iXGQFi5Bw@mail.gmail.com>
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com>
 <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
 <4F80C739.2060404@gmail.com> <CAGa2bXZSgV3bRPGMt6Esw16v3ErVMLVQy1fb8cZxdc=OokpXKg@mail.gmail.com>
 <4F817DE1.3020608@gmail.com> <CAGa2bXYQ0r9mr7AfQZyN8iVzDXV2rca_eK=ZWgtt2iXGQFi5Bw@mail.gmail.com>
Date: Mon, 9 Apr 2012 06:03:25 +0900
Message-ID: <CAGa2bXZnrUuRirJB3Fg4yyJWE_Tw2MYz4AvwJgCV+6MZ6siFXg@mail.gmail.com>
To: =?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>
Cc: PHP Developers Mailing List <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

2012/4/9 Yasuo Ohgaki <yohgaki@ohgaki.net>:
> Hi,
>
> You are missing my points.
>
> 2012/4/8 =C1ngel Gonz=E1lez <keisial@gmail.com>:
>> 2012/4/8, Yasuo Ohgaki:
>>> 2012/4/8 =C1ngel Gonz=E1lez <keisial@gmail.com>:
>>>> How does it help security?
>>>> If any, requiring '<?php' before executable code makes easier to filte=
r
>>>> out malicious files on apps with uploads in case there's a local
>>>> inclusion vulnerability somewhere.
>>>>
>>> Attackers may inject PHP script almost anything/anywhere since
>>> PHP code may be embed anywhere in a file.
>>>
>>> For example, malicious PHP script may be in GIF something like
>>>
>>> gif89a ...any data.. <?php exec('rm -rf /') ?>
>>>
>>> and all attacker have to do is include/require the data somehow.
>>> Attacker cannot do that this for other languages, since they are
>>> not a embedded language. I know case that attackers may inject
>>> malicious perl/ruby script in data files, but PHP is too easy
>>> compare to these languages.
>>>
>>> Regards,
>>>
>>> --
>>> Yasuo Ohgaki
>> Yes, but if I properly check that there's no '<?php' in the uploaded fil=
es
>> (as you should verify everything you allow users to upload), it can't be
>> exploited.
>> OTOH if the vulnerable include is not an include but an include_code,
>> they could
>> use a file which was
>
> Checking "<?php" is not enough obviously.
> One should check "<?" and "<%" also and there are many data
> files that may contain "<?" and "<%".
>
> Embedding PHP script in image file is popular attack method.
> There is even program called image fight that inject "<?php die()?>"
> into uploaded images to prevent hosting malware images.

I should not forget to mention, one should check

<script language=3D"php">

also.

--
Yasuo Ohgaki
yohgaki@ohgaki.net


>
> Attacker may inject PHP script into anywhere/any file. Disabling
> embed mode is simple and effective countermeasure.
>
>>> exec("rm -rf"); // Example of what not to do
>> And was happily uploaded as "plain text".
>
> There are 2 types of attacks, one is directly uploading PHP script.
> Another is include PHP script. Uploading as plain text does not help.
>
> Regards,
>
> --
> Yasuo Ohgaki