0

I saw a pentest report and there was a section where the pentester list all the functions that are vulnerable in PHP. How did he scan the code and what tools can be used, and is it possible to do it without having an access to the files?

For example:

PHP "phar_fix_filepath" function stack buffer overflow vulnerability

closed as too broad by Hector, S.L. Barth, Serge Ballesta, Tobi Nary, Steve Dec 4 '17 at 14:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Did you voluntarily give access to code files to the pen-tester? If not, then you've reason to get worried. – pri Dec 4 '17 at 8:43
  • 1
    This question is far too broad and shows next to no attempt to research this. Literally googling "PHP "phar_fix_filepath" function stack buffer overflow vulnerability" the first result is securityfocus.com/bid/75970 which lists several vulnerable PHP versions."php vulnerability scanner" is another easy search. – Hector Dec 4 '17 at 8:43
  • @PriyankGupta can a pentester do this without an access to the files? – mrashid Dec 4 '17 at 8:48
  • 1
    if you didn't give access to code, maybe they gained access to your application and your whole code. i haven't heard of any automated tests that can detect what functions have been used in a application. but if they have provided a list of random vulnerable functions, will that's something else. – senaps Dec 4 '17 at 8:50
  • 1
    phar_fix_filepath function is called automatically inside of PHP by several core functions and extensions. @senaps and Priyank Gupta seem to be assuming you have called it yourself - there is absolutely no evidence of this. There is no way any vaguely competent pentester would obtain access to your source code without you giving it to him and not immediately make you aware - that would be a major security hole. He's likely just run a load of automated scripts that test for known vulnerabilities in your tooling. – Hector Dec 4 '17 at 8:58
4

It's important to note here that phar_fix_filepath is not a PHP function that your web app uses. It's a function in the C source of the PHP engine. You security issue that the pentester is referencing is probably CVE-2015-5590:

Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.

So what has the pentester done here? She has probably checked what version of PHP you are using (by default this is conveniently displayed in a HTTP response header, but it can also be found through fingerprinting). Then she just needs to check any list of known vulnerabilities to see which ones affect that version.

But does the pentester know that your code results in this function being executed and that the vulnerability can be exploited? Probably not. My guess is that she is satsified with pointing out that the PHP version is vulnerable, no matter if your app is affected or not. And honestly, that is bad enough. Even if this can't be exploited at the moment, the slightest change in the source code might change that fact. You need to upgrade your PHP engine no matter what.

With that view, you don't need access to the source code, since the analysis is based only on the version number. If one were to determine if your app can actually be exploited, access to the source code would help a lot, though.

Not the answer you're looking for? Browse other questions tagged or ask your own question.