3

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker.

Say I am running Apache with a single empty folder, uploads, and a single file, index.php, in my webroot as below:

<?= "Hello World" ?>

If I was to set folder and file permissions to 777, can this be exploited?

  • 1
    If you are using a shared server, anyone with an account on the same server can put any file they want on your directory. And this PHP script does nothing. – ThoriumBR Jan 4 '16 at 20:01
  • @ThoriumBR the PHP script was intentional. I was wondering what damage one could do without exploiting a code vulnerability. Good point on the shared server though. – topher Jan 5 '16 at 13:25
2
  1. It means that anyone can write to your folder , so someone can put (by using http PUT method curl http://myservice --upload-file file.txt)and call a cgi script that delete all your files or do whatever he/she wants.

  2. Your index.php can also be delete by using:

      curl -X delete www.yoursite.com/index.php
    

But these two methods also depend on Apache configuration , which methods you have allowed and which are not allowed. You can see which methods a server allows , by using curl -I url command

Reference:

HTTP delete

The DELETE method requests that the origin server delete the resource identified by the Request-URI. This method MAY be overridden by human intervention (or other means) on the origin server. The client cannot be guaranteed that the operation has been carried out, even if the status code returned from the origin server indicates that the action has been completed successfully. However, the server SHOULD NOT indicate success unless, at the time the response is given, it intends to delete the resource or move it to an inaccessible location.

A successful response SHOULD be 200 (OK) if the response includes an entity describing the status, 202 (Accepted) if the action has not yet been enacted, or 204 (No Content) if the action has been enacted but the response does not include an entity.

  • On your first point, how can they "upload" the cgi script? – topher Jan 4 '16 at 8:25
  • By using http put method. Answer updated – Ijaz Ahmad Khan Jan 4 '16 at 8:38
  • Perhaps a better reference is: wiki.linuxquestions.org/wiki/…. It explains why PUT and DELETE are dangerous. – topher Jan 5 '16 at 13:43
0

it will allow the attackers can modify as well as delete this file if the attackers have already uploaded some malicious files such as php shell or so, they can easily deface your website or make fun of it. Another case is you should check your HTTP methods, to see if the Put and delete methods are optional. If it's not then this is a chance for random people can change and delete the file right away. See more here: https://tools.ietf.org/html/rfc7231#section-4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.