2

I'm assessing the security of a webportal for a client and I found a vulnerability.

I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function is directly callable and it doesn't check auth. Anyway, here are the conditions:

Upload takes 2 arguments (lets say), ID (should be int, if its not int, it breaks the code and no upload), file object.

When file is uploaded, it checks for the extension of file using: pathinfo['extension']. If extension is one of the followings: "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

it breaks the upload.

Otherwise, it means all checks are passed and it places the file in: /uploads/$ID.$EXT

P.S. It reads entire POST/GET data (using php://input) if it finds "%00" (uses regex) in the POST/GET/COOKIE/... anything, it breaks the whole connection.

So to summarize, it does 3 checks:

  • %00 in POST/GET by reading php://input and searching for %00
  • $ID to be int
  • Extension of file, shouldn't be equal to "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

It it a vulnerability? Can we bypass the tests and cause damage? RCE?

P.S. It's a Linux server.

2
  • What is the web server technology? What kind of scripts is it capable of executing? Anything other than PHP? Jan 16, 2018 at 9:44
  • Apache webserver, Ubuntu 14, only executes PHP
    – GMX Rider
    Jan 16, 2018 at 14:50

2 Answers 2

1

I'm not sure what the value in their searching for %00 is. (I mean, I guess truncating filenames on really old versions on PHP?)

If the webserver is configured to send all requests to PHP, you can use alternate extensions (.html) and try to get code execution that way. If they've carefully configured to only allow PHP execution for the file extensions they are filtering, I would consider whether any other scripting languages are installed. (e.g., mod_python)

Regardless of RCE on the server, if they're allowing HTML content to be uploaded on the same origin that they host the site, you almost certainly have an XSS vector...

1
  • Sorry, updated the question, the server also doesn't allow html/html extensions. Will try mod_python, thanks!
    – GMX Rider
    Jan 15, 2018 at 21:23
0

I've managed to gain RCE on a similiar setup uploading a PHP file with the .pht, .phtm, .phar and probably other extensions that usually aren't filtered.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .