6

On some sites such as WriteCodeOnline, sprintf, vsprintf and other related formatted string functions are disabled for security reasons:

Warning: vsprintf() has been disabled for security reasons on line 1

I'm wondering what these security reasons are. I've already read the Wikipedia article on Uncontrolled format string but it only addresses the aspects of using printf in C.

What are the security issues of executing *printf on PHP? Obviously the function isn't meant for preventing SQL injections, but that's a matter of using the correct tool for the job.

Improve this question
5
  • 1
    If you include unfiltered user content as the input, you're enabling XSS. Taint has to be removed.
    – Fiasco Labs
    Oct 11, 2014 at 19:25
  • 1
    But XSS is also possible with echo if the input is untrusted
    – rink.attendant.6
    Oct 11, 2014 at 19:53
  • 1
    "but it only addresses the aspects of using printf in C" - True, but that works well in php too.
    – Gerifield
    Oct 11, 2014 at 20:03
  • 1
    @Gerifield - Yep, given that perl and php which is related to it are based on a subset of C conventions, there is an issue of inheritance.
    – Fiasco Labs
    Oct 11, 2014 at 20:26
  • possible duplicate of stackoverflow.com/questions/9895838/…
    – user45139
    Oct 11, 2014 at 23:19

2 Answers 2

Reset to default
6

Yes, it's not C/C++ language; however, perl, PHP, ruby and java are descendents that carry on various C language conventions. By not having %n, php gets rid of part of the problem, but it still has %x which can be exploitable under certain circumstances.

Basically, printf() and its variants can allow control of the format string if you don't specify it.

Unvalidated user input can supply the format string of their choosing that will lead to a buffer overflow like condition (not a true buffer overflow).

Modern perl and PHP will throw warnings during the development phase so you don't create code missing the format string, if you choose to ignore them, you can have an issue.

Since the site you're referencing allows you to put in any old darn thing to test code, they are preventing creative format strings being entered into printf() that can eat memory, create a denial of service attack, cause premature program termination or crash the PHP interpreter on that website.

Format String Vulnerability in C

Improve this answer
1
  • 2
    Thanks for the answer and the link. Is there an example somewhere that demonstrates an exploit with %x? I would assume that %x performs something like JavaScript's parseInt(foo, 16) on the variable. Also I think that suppressed warnings would silently fail but is there a security issue with that?
    – rink.attendant.6
    Oct 12, 2014 at 1:09
2

Not in any traditional sense, as PHP's sprintf doesn't support any of the really dangerous conversions like %n. A user-controlled format string can still cause some limited havoc (consider %99999999s), but about the worst, It could do would be to consume memory and time.

following is an integer overflow. Which leads to the following code:-

<?php
echo sprintf('%2147483646$s', "foo"); # Warning: Too few arguments
echo sprintf('%2147483647$s', "foo"); # Warning: Argument number must be greater than zero

PHP Bug #61531

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .