3

Is it possible to perform null byte injection on PHP code? And, how would vulnerable code look like? Could you give me some examples, as I noticed that:

<?php

echo $_GET['get'];

Will not make code vulnerable. I want to know, what are possible security flaws in code that can cause this kind of vulnerability, if possible. Any example would be appreciated and useful.

5

Null byte injection in PHP concerns how null bytes are handled in filesystem operations. If an attacker can inject a null byte into a filepath, the underlying C function will disregard anything after the malicious character. This can be used in order to bypass constraints such as the intended file's extension.

The following example is from php.net:

<?php
$file = $_GET['file']; // "../../etc/passwd\0"
if (file_exists('/home/wwwrun/'.$file.'.php')) {
    // file_exists will return true as the file /home/wwwrun/../../etc/passwd exists
    include '/home/wwwrun/'.$file.'.php';
    // the file /etc/passwd will be included
}
?>

http://www.php.net/manual/en/security.filesystem.nullbytes.php

In this case, the '.php' extension will be ignored during file operations if the user submits a null character at the end of the file parameter. Combined with a directory traversal string, it allows the attacker to "include" arbitrary files that will be disclosed.

4

This information is only relevant for older (unsupported) versions of PHP.

Null byte injection has been fixed in PHP 5.3.4 (which it's self is already an old and unsupported PHP version): https://bugs.php.net/bug.php?id=39863.

  • It was fixed for a limited subset of functions. The vulnerability in (include/require)(_once) persisted. On some instances, when magic_quotes_gpc is enabled, the null-byte is escaped and that induce the idea of it being fixed. – FanaticD Feb 26 '18 at 6:20

protected by Community Apr 6 at 17:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.