2

Is it possible to leak the server-side code of a website if a GET request is sent instead of a POST request to a page? The idea is that if a POST request is made to a webpage e.g. http://<server url>/index.php, then the parameters passed via the POST request get read, the server side code e.g. PHP gets executed and a HTML output is returned to user. However, if a GET request is sent for a webpage to the server, then the server does not execute the server-side code - it simply returns index.php to the end user leaking the server-side code.

I have heard that this is a common vulnerability, but I am unable to find scenarios where this exists. Also what server configurations would typically allow this vulnerability to occur?

Thanks

John

1
  • 1
    I think you will find that this is not true if you perform tests on any PHP website. You might be able to curl pages, if the server is not configured correctly.
    – schroeder
    Commented Dec 3, 2015 at 16:10

3 Answers 3

3

However, if a GET request is sent for a webpage to the server, then the server does not execute the server-side code - it simply returns index.php to the end user leaking the server-side code.

Your assumption is wrong. A GET or POST does not change anything related to sourcecode leak. They are processed the same way, and the result will usually be HTML being sent back.

Main differences between POST and GET:

  • A GET request will show fully in the address bar, and a POST does not

    Bookmarking a GET request with a password will also record the password, and a POST will not.

  • A GET request gets written fully on webserver logs, a POST generally not

    If someone reads the logs of the webserver, all info of all requests can be read from a GET, but not from a POST

Using POST will make slightly harder to someone to conduct a CSRF attack against your site. But have absolutely nothing to do with a source leak.

2

The closest match I can find is this vulnerability.

A simple abuse case for this vulnerability is obtaining the source code for any PHP file on the site, which can be done with a simple "-s" query parameter

For example if the page is example.com/foo.php you would simply add -s to make example.com/foo.php-s. This will reveal the source code on a vulnerable system.

However, the article doesn't state that this requires a GET request, although it is easier to do via GET as you just alter the request in your browser.

2
  • I've also seen something similar on unpatched ESX servers, that if you request via capitals rather than lower case it leaks (i think, Java IIRC) source code. Looking for the CVE now, but it was related to the server, and isn't PHP Commented Dec 3, 2015 at 16:21
  • here it is:kb.vmware.com/selfservice/microsites/… Commented Dec 3, 2015 at 16:29
-4

yes it is possible and it is pretty common technique actually. This method of using GET request that potentially conduct several locations (such as browser history, http log files, headers and so on) is called Cross Site Request Forgery (CSRF).

You can find the in deep details information about CSRF on OWASP web site.

For your convenience here is the link: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

There you will find clear step and you can re-produce the scenario you are looking for.

3
  • 8
    CSRF doesn't enable source code to be leaked. Commented Dec 3, 2015 at 16:17
  • sorry I actually missed that part, source code leaking....but for the rest of the question csrf is the way is...
    – ostendali
    Commented Dec 3, 2015 at 16:38
  • 2
    Perhaps you should reread the question. My reading is that the entire question is about leaking source code. Commented Dec 3, 2015 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .