3

According to the OWASP PHP cheat sheet:

Using $_REQUEST is strongly discouraged. This super global is not recommended since it includes not only POST and GET data, but also the cookies sent by the request. All of this data is combined into one array, making it almost impossible to determine the source of the data. This can lead to confusion and makes your code prone to mistakes, which could lead to security problems.

I understand why this is bad practice from a programming perspective, but I do not understand the security implications of this. Since the attacker - the person sending the request - has full control over all three - get variables, post variables and cookies - I don't see what difference it makes.

One issue I could see is if e.g. a WAF checks the query string for suspicious behaviour, so the attacker instead delivers the payload in a cookie. But is there any other issues? Can anyone give me a concrete example of how the usage of $_REQUEST would cause a vulnerability?

  • Some kind of session fixation attack perhaps? – CodesInChaos Oct 12 '17 at 11:36
4

This is because it widens the scope of reflective XSS to POST requests, as most scripts don't check the HTTP verb explicitly.

Imagine you've got the following code in a script that usually expects a POST request:

<?php
if (($order = $orders->fetch($_REQUEST['id'])) === FALSE)
{
    die('Could not find order number ' . $_REQUEST['id']);
}
...

If $_POST were used, the XSS vulnerability would still exist, but it could only be triggered by a user going to an attacker-controlled page first so that a form could send the exploit via POST. Instead, the attacker only needs to get the victim to click a link such as:

http://example.com/vulnerable.php?id=<script>alert(document.cookie);</script>

It's also a concern for other verb-confusion attacks, where two parts of the script make separate judgements on the verb being used (e.g. one assumes it's a GET, the other a POST) resulting in unexpected behaviour.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.