Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72495
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52FB0D15.9040303@lsces.co.uk>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
 <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com>
 <52FA67A4.3030708@lerdorf.com> <CAGa2bXaHTCx+8=BJH-L+KqANo9NtEML3cp2sJqgv1jmGLYXaGg@mail.gmail.com>
 <52FAB58E.3080701@lsces.co.uk> <CAGa2bXbSD2xnOfptvZZu5Bj-L1LV5n213xB5C=haAd1vX8dfog@mail.gmail.com>
 <52FB0920.8040903@lsces.co.uk> <52FB0D15.9040303@lsces.co.uk>
Date: Wed, 12 Feb 2014 15:17:38 +0900
Message-ID: <CAGa2bXZx9Q6Lzd8PyDMrgudSH22uiHzJhkk+YEeu2Zue4dQeBQ@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c33530f0cf1304f22f898d
Subject: Re: [PHP-DEV] Re: [RFC] No PHP tags
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c33530f0cf1304f22f898d
Content-Type: text/plain; charset=UTF-8

Hi Lester,

On Wed, Feb 12, 2014 at 2:56 PM, Lester Caine <lester@lsces.co.uk> wrote:

> Lester Caine wrote:
>
>> can you really protect them anyway?
>>
> Yasuo
> Have you actually looked at the 'Some recent LFI issues' that are listed?
> I don't thing any one of them would have been protected from by this
> change? Providing a php page that can DISPLAY or run any file that it can
> read is not going to be protected from by switching embedding off?


1st one is file upload vulnerability. I'll replace it something else.
2nd one is

http://seclists.org/bugtraq/2012/Apr/53

    $filepath = "$path_to_citrus/$load.php";
                if (file_exists($filepath)) {
                        include('./'.$load.'.php');

I'm not sure what they are loading. script() prevents from reading
/etc/passwd or any other files.

3rd one is
https://localhost/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00

It could also be protected by script().

4th one is
http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd

The same as 3rd one.

It works well for LFI. Important thing is include()/require() needs extra
care to make sure it's secure. I would suggest to validate all inputs, but
user may have invalid validation. Single mistake could be serious
disaster. It's better if there is script() for sure. (Defense in depth)

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c33530f0cf1304f22f898d--