Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83706
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.51 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54ECF605.7030506@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
 <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
 <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
 <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
 <54ECD4E3.9040705@gmail.com> <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
 <54ECF605.7030506@gmail.com>
Date: Wed, 25 Feb 2015 07:24:31 +0900
Message-ID: <CAGa2bXZGp5fxu1mPa8bYYSZoxnwpd7Uzq6Be7x3K3HRQxeENPg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>, 
	Dmitry Stogov <dmitry@zend.com>, "internals@lists.php.net" <internals@lists.php.net>, 
	Nikita Popov <nikitappv@gmail.com>
Content-Type: multipart/alternative; boundary=001a11c1640002861d050fdcfece
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c1640002861d050fdcfece
Content-Type: text/plain; charset=UTF-8

Hi Stas,

On Wed, Feb 25, 2015 at 7:07 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> > They'd need to upload with a matching file type. Instead of any file
>
> Not sure what you mean by that. phar can read tars, etc. AFAIK, can't
> it? Also, phar archive has no requirement of being named something.phar,
> afaik can be also named cuteponies.gif. E.g., I just did this:
>
> 1. Created file chump.php:
>
> <?php
>
> include $argv[1];
>
> This is an idealized vulnerable script.
>
> 2. Created file pwnd.php
> <?php
>
> echo "pwnd!";
>
> This is an idealized exploit.
>
> 3. Put it into an archive:
> tar cvzf cuteponies.gif pwnd.php
>
> 4. Run this:
>
> php -dallow_url_include=0 chump.php phar://cuteponies.gif/pwnd.php
>
> The output is:
>
> pwnd!
>
> I'm not sure how this measure would protect from such scenario. Am I
> missing something here?


I think he means matching file "extension". File extension should represent
file type, though.

The new RFC check filename extensions. It allows only ".php", ".phar" as
PHP script
and move_uploaded_file() restricts moving PHP scripts by default. (Old idea
was to
detect PHP script by contents. New RFC is to restrict PHP script file
extension.)

Since "pwnd.php" has ".php" extension, move_uploaded_file() refuses to move
it
to upload dir by default.

As long as user uses default and move_uploaded_file(), they are free from
script upload attacks including embedded script.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c1640002861d050fdcfece--