2

I am programming a way in PHP for my users to be able to access a remote API though my website. I was wondering if any of you had some input on whether or not this was secure (NOT considering any vulnerabilities that may be on the remote system)

print file_get_contents("https://website.com/?uid={$_GET['uid']}");

Is this secure? if not, can you explain why?

Note: The site does not return any value that is sent using the uid parameter.

  • What is returned from the request? Is the content user generated? – multithr3at3d Nov 11 '19 at 22:28
  • You used c/c++ before PHP, didn't you? – Conor Mancone Nov 12 '19 at 2:16
  • @Conor .. maybe =) @ multithr3at3d - no, it's just basically a static text document that is returned. – xorist Nov 12 '19 at 21:46
  • I went ahead and PHP-ified it, partly because it's shorter (and equally readable for people used to PHP), and partly to make it look a bit more like how it would "typically" be done in PHP. – Conor Mancone Nov 12 '19 at 22:52
1

I see three issues with this:

  • An attacker could set other query parameters than uid by e.g. using 123&foo=bar. Depending on how your site and how website.com works, this could lead to unexpected behaviour. To mitigate this, use some sort of whitelisting or filtering. E.g. if uid should always be a number, check that $_GET['uid'] only contains digits first.

  • Whoever can control content on website.com can not control content on your site. This basically means that anyone who has access (legitimate or not) to website.com can XSS you or spread malware through your site. If you don't trust them fully, don't do this. Or make sure the Content-Type header is set to something where this is not an issue.

  • Open redirects! If website.com has an open redirect vulnerability, you have a big problem. An attacker can now make your site serve basically anything! You could tell PHP not to follow redirects to solve this, but if website.com relies on redirects for functionality this might cause you trouble.

  • Thank you for the answer, though I specify in the question that I'm looking particularly for only issues related to the method of calling out to the server and not issues related to the remote system it's self. (i.e., is there a way I could get out of the parameter declaration and open redirect via the method of accessing the remote system that's being used?) Though I didn't intend to specify such a specific question because I'm looking for answers even beyond just that. – xorist Nov 13 '19 at 23:53
  • @xorist I have added some mitigations suggestions. – Anders Nov 14 '19 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.