3

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker.

Say I am running Apache with a single empty folder, uploads, and a single file, index.php, in my webroot as below:

<?= "Hello World" ?>

If I was to set folder and file permissions to 777, can this be exploited?

Improve this question
2
  • 1
    If you are using a shared server, anyone with an account on the same server can put any file they want on your directory. And this PHP script does nothing.
    – ThoriumBR
    Commented Jan 4, 2016 at 20:01
  • @ThoriumBR the PHP script was intentional. I was wondering what damage one could do without exploiting a code vulnerability. Good point on the shared server though.
    – topher
    Commented Jan 5, 2016 at 13:25

2 Answers 2

Reset to default
2

  1. It means that anyone can write to your folder , so someone can put (by using http PUT method curl http://myservice --upload-file file.txt)and call a cgi script that delete all your files or do whatever he/she wants.

  2. Your index.php can also be delete by using:

      curl -X delete www.yoursite.com/index.php

But these two methods also depend on Apache configuration , which methods you have allowed and which are not allowed. You can see which methods a server allows , by using curl -I url command

Reference:

HTTP delete

The DELETE method requests that the origin server delete the resource identified by the Request-URI. This method MAY be overridden by human intervention (or other means) on the origin server. The client cannot be guaranteed that the operation has been carried out, even if the status code returned from the origin server indicates that the action has been completed successfully. However, the server SHOULD NOT indicate success unless, at the time the response is given, it intends to delete the resource or move it to an inaccessible location.

A successful response SHOULD be 200 (OK) if the response includes an entity describing the status, 202 (Accepted) if the action has not yet been enacted, or 204 (No Content) if the action has been enacted but the response does not include an entity.

Improve this answer
3
  • On your first point, how can they "upload" the cgi script?
    – topher
    Commented Jan 4, 2016 at 8:25
  • By using http put method. Answer updated
    – Ijaz Ahmad
    Commented Jan 4, 2016 at 8:38
  • Perhaps a better reference is: wiki.linuxquestions.org/wiki/…. It explains why PUT and DELETE are dangerous.
    – topher
    Commented Jan 5, 2016 at 13:43
0

it will allow the attackers can modify as well as delete this file if the attackers have already uploaded some malicious files such as php shell or so, they can easily deface your website or make fun of it. Another case is you should check your HTTP methods, to see if the Put and delete methods are optional. If it's not then this is a chance for random people can change and delete the file right away. See more here: https://www.rfc-editor.org/rfc/rfc7231#section-4

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .