2

I'm assessing the security of a webportal for a client and I found a vulnerability.

I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function is directly callable and it doesn't check auth. Anyway, here are the conditions:

Upload takes 2 arguments (lets say), ID (should be int, if its not int, it breaks the code and no upload), file object.

When file is uploaded, it checks for the extension of file using: pathinfo['extension']. If extension is one of the followings: "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

it breaks the upload.

Otherwise, it means all checks are passed and it places the file in: /uploads/$ID.$EXT

P.S. It reads entire POST/GET data (using php://input) if it finds "%00" (uses regex) in the POST/GET/COOKIE/... anything, it breaks the whole connection.

So to summarize, it does 3 checks:

  • %00 in POST/GET by reading php://input and searching for %00
  • $ID to be int
  • Extension of file, shouldn't be equal to "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

It it a vulnerability? Can we bypass the tests and cause damage? RCE?

P.S. It's a Linux server.

  • What is the web server technology? What kind of scripts is it capable of executing? Anything other than PHP? – Mukesh Sai Kumar Jan 16 '18 at 9:44
  • Apache webserver, Ubuntu 14, only executes PHP – GMX Rider Jan 16 '18 at 14:50
1

I'm not sure what the value in their searching for %00 is. (I mean, I guess truncating filenames on really old versions on PHP?)

If the webserver is configured to send all requests to PHP, you can use alternate extensions (.html) and try to get code execution that way. If they've carefully configured to only allow PHP execution for the file extensions they are filtering, I would consider whether any other scripting languages are installed. (e.g., mod_python)

Regardless of RCE on the server, if they're allowing HTML content to be uploaded on the same origin that they host the site, you almost certainly have an XSS vector...

  • Sorry, updated the question, the server also doesn't allow html/html extensions. Will try mod_python, thanks! – GMX Rider Jan 15 '18 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.