0

I am using shell_exec function on the following variables to execute commands on the shell:

  1. fname (characters only)
  2. fpack(characters only)
  3. email (a valid email address)

My code is:

<?php

require_once 'connectionToDB.php';

$fname = mysqli_real_escape_string($dbc, filter_var(escapeshellarg($_POST['fname']), FILTER_SANITIZE_STRING));
$fpack = mysqli_real_escape_string($dbc, filter_var(escapeshellarg($_POST['fpack']), FILTER_SANITIZE_STRING));
$email = mysqli_real_escape_string($dbc, filter_var(escapeshellarg($_POST['email']), FILTER_SANITIZE_EMAIL));

/** Verify name of applicaion **/
if(!ctype($fname)) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Application name must be in english alphabetical letters only'));
    die($op);
}
if(strlen($fname)>20) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Application name must be less than 20 characters'));
    die($op);
}

/** Verify name of package **/
if(!ctype($fpack)) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Package name must be in english alphabetical letters only'));
    die($op);
}
if(strlen($fpack)>20) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Package name must be less than 20 characters'));
    die($op);
}

/** Verify user's email **/
if (strlen($email)>50) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Email must be of less than 50 characters'));
    die($op);
}

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $op = json_encode(array('type' => 'error', 'msg' => 'Please provide a valid email address.'));
    die($op);
}

As I said I am using shell_exec on these variables, I am scared of remote command execution. Is my code safe enough to prevent RCE?

6

No, this is not secure.

Most of the code doesn't even make sense. It looks like you've simply thrown all functions you know at the variables in the hopes that this will somehow help. That's a very poor approach. Not only does is not work; it actually introduces bugs and may lead to severe problems.

Neither MySQL-escaping nor HTML-filtering (through FILTER_SANITIZE_STRING) have anything to do with the shell. SQL, HTML and the language used by your shell are three entirely different contexts and require entirely different security procedures. You cannot randomly combine them. For example, mysqli_real_escape_string() will break the quoting of escapeshellarg() and may indeed enable the user to manipulate the shell command.

Also note that most of those functions you're using are destructive, which means they silently change the data entered by the user. This is a very bad idea, because you may end up executing commands which the user never wanted you to execute. Either accept or reject the user input, but do not silently replace it with something else.

So you'll need a very different approach:

  • Validate the raw user input. If it's not acceptable, stop and throw an error.
  • Then prepare the input for the specific context you want to use it for. In the case of shell arguments, only use escapeshellarg() to properly escape the input for shell contexts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.