0

TLDR:

  • I want to reproduce the RCE from phar file deserialization described in GitHub/advisory/97m3.
  • I fabricate an html file that includes a malicious svg file in its <img> tag.
  • Adding debug prints, I make sure I hit file_exists with my phar filename.

My question:

  • how can I upload the actual phar file (whose name I control) ?
  • What I tried:
    • adding another <img> tag with the src being the phar file
    • sending the phar file as another attachment alongside the html file

All the details for my experiment are included in my public GitHub repo:

$ git clone https://github.com/OrenGitHub/dhscanner.examples.git
$ cd dhscanner.examples/cve_2023_50262/example_00
$ cat README.md

I follow the instructions in the README.md shown below for completeness:

$ docker build --tag host.ghsa_97m3 --file Dockerfile .
$ docker run -p 8002:8000 -d -t --name ghsa_97m3 host.ghsa_97m3
$ Set-Variable -Name X -Value (curl.exe -c cookiejar -X GET http://127.0.0.1:8002/token)
$ echo $X
kCnrA9SNT7GtFW1jvUQAm3Om9NsmECs487Zd8hhD # <--- good !
$ curl.exe -b cookiejar --header "X-CSRF-TOKEN:$X" -X POST http://127.0.0.1:8002/test
999 666 MMM # <--- good !
$ curl.exe -b cookiejar --header "X-CSRF-TOKEN:$X" -F "[email protected]" -X POST http://127.0.0.1:8002/ghsa_97m3
>>> calling file_exists(/frontend/vendor/dompdf/dompdf/lib/fonts/Times-Roman.afm)
>>> calling file_exists(./Times-Roman.afm)
>>> calling file_exists(phar://baz.phar/test.ufm) # <--- a call to file_exists with phar file - good !
>>> calling file_exists(phar://baz.phar/test.ufm) # <--- a call to file_exists with phar file - good !
Unable to stream pdf: headers already sent

So the only missing element is uploading the baz.phar file somehow ... any help is very much appreciated !

1 Answer 1

0

I think my blind spot was around the fact that indeed, the vulnerability description is not about uploading the actual phar file, but rather about calling

file_exists(file that starts with "phar://whatever/you/want/here")

Since phar files can disguise themselves as image files (at least from the standpoint of file suffix, and magic bytes), uploading a malicious phar file as a profile image might be possible

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .