Friday, February 1, 2008

PHP Downloader Vulnerability

Hi Folks,
this morning I wanna point out a very useful (ok, it depends :) ) vulnerability found inside some PHP Downloader. First of all Let me say what is a vulnerability: " We call vulnerability a bug with security implications " . So if your code has a bug probably it could be vulnerable at some kind of attacks. In this particular scenario the code looks like that:




No controls on file type, no controls on location. Just give the file's name and the file's path and it'll open it in read mode. This is a bug. Why this bug can been considered Vulnerability ? Because if you ask some specific System's files to this downloader implementation, it will give you every files you want.
Just for example you can try with the following URI (maybe someone has been fixed):


http://www.mpbp.gov.my/download.php?file=download.php
http://elearning.mmu.edu.my/download.php?file=download.php
http://www.utem.edu.my/fkp/latihanIndustri/download.php?file=../../../../../../etc/passwd
http://www.moe.gov.my/pipp/download.php?filename=/../../../../../../etc/passwd


One of the previous URI gave me the following file which shows the passwd file of the machine. Here it is.



As you may see, from the users names, it's very easy to figure out which kind of services the machine has. For instance the machine runs clam AntiVirus, ssh server, virtual console, MySQL and so forth. For the most experts of you, it's easy forging this request exploiting the server asking for passwords' file and/or for system's files... Thanks to google, this bug which is just became a Vulnerability; can reach the MassVulnearbility status and - if coded inside a script - (for instance a perl script) it can become a Massive Exploit. Why I'm saying that ? Using google it's easy to find lots of different pages affected to this bug. Just typing : inurl:”download.php?file=*.pdf” you will find lots of download.php file. Now try to change some parameters on the URI bar and here we are ! You've just found plenty of vulnerable downloader scripts. Well, this post doesn't want teaching how to overuse this Vulnerability, it doesn't want teaching hacking and/or how to break security too. I wanna only say -through it- that, not every bug is a vulnerability and also not every vulnerability comes from a bug (let think to Social Engineering), BUT most of vulnerabilities come from developer and/or programming mistakes. For this reason it so important don't sleep a code.... trying to avoid this elementary security mistakes.... and it's so important having a good software engineering project behind your shoulders able to prevent and, at least, to correct quickly these mistakes.

28 comments:

Marco Fabbri said...

Speaking about avoiding this coding mistake... a solution could be proxing the download request through a file list/database; i.e. having on a database a list of the downloadable files and hence getting the file path by the means of an id. Creating a loophole in a upper system level to expose some convenience feature of underlying levels it is a very bad, bad idea and practice; if you think you definitely need it, well, think again.
As always an interesting post ;) rising the level of security awareness. Keep up with the good work!

Anonymous said...

miley cyrus nude [url=http://crystal-liu.com/forums/index.php?showuser=1113]miley cyrus nude[/url] miley cyrus sex tape [url=http://forum.ondertitel.com/index.php?showuser=74503]miley cyrus sex tape[/url] miley cyrus nude [url=http://stabilo.forumsunlimited.com/index.php?showuser=799]miley cyrus nude[/url] miley cyrus nude [url=http://ragga-jungle.com/user/15036-vebsterd]miley cyrus nude[/url] kim kardashian nude [url=http://forums.quark.com/members/vebsterd.aspx]kim kardashian nude[/url]

Anonymous said...

miley cyrus nude [url=http://www.ipetitions.com/petition/mileycyrus]miley cyrus nude[/url] paris hilton nude [url=http://www.ipetitions.com/petition/parishilt]paris hilton nude[/url] kim kardashian nude [url=http://www.ipetitions.com/petition/kimkardashian45]kim kardashian nude[/url] kim kardashian nude [url=http://www.ipetitions.com/petition/celebst]kim kardashian nude[/url]

Anonymous said...

[color=#808080]Музыкальный ансамбль [url=http://dejavu-group.ru/artist.php]Dejavu-group[/url] - это коллектив дипломированных вокалистов и музыкантов на праздник.
[url=http://dejavu-group.ru/svadba.php]Deja Vu[/url]- лидер в области организации и проведения свадеб, дней рождения, корпоративных вечеров, шоу программ.
В копилке Музыкантов Deja Vu более 3000 песен.
Живая музыка. Поп, хиты 70-80-90-х, диско, джаз, ретро, современная музыка, европейские хиты, фоновая музыка, шансон .
Музыкальная группа Дежа вю обладает мощной качественной музыкальной аппаратурой, которая позволяет заполнить плотным и приятным уху звуком как маленькое помещение (фуршет), так и огромное помещение (корпоратив до 1000 человек).

Андрей +7 910 483 8294 [/color]

Anonymous said...

[color=#808080]
Как дела? Может-быть... есть cупер мысль по[url=http://www.pi7.ru] видео[/url] порталу Думаю вам понравится

[url=http://www.pi7.ru]девочки в бане[/url]
aнекдот для разнообразия :)

Сидят два деда в куста, испражняются. Один другому:
- А помнишь, рагьше, время было, яйца то до земли доставали.
- Да, ослеа земля, осела.

Я 7 часво блуджала по сети, пока не вышела на ваш форум! Дмуаю, я здесь останусь надолго!
прошу прощенря за опечатки.... очень амленькая клавиатура у PDA!

[/color]

Anonymous said...

[... ] is one relavant source on this topic[...]

Anonymous said...

virginia dating laws [url=http://loveepicentre.com/]worksop dating service[/url] downloadable simulation dating games http://loveepicentre.com/ stocks backdating

Anonymous said...

[b]Автоспутник Украина[/b]

Внесены уточнения дорожной сети и адресной базы городов Киев и Днепропетровск.
Добавлены отсутствующие сегменты трассы Харьков – Днепропетровск.
Добавлена подробная дорожная сеть во всех населенных пунктах Киевской области: Бровары, Ирпень, Боярка, Вишневое, Фастов, Украинка, Обухов, Васильков, Узин, Белая Церковь, Сквира, Тараща, Богуслав, Мироновка, Кагарлык , Ржищев, Яготин, Переяслав-Хмельницкий, Березань. В данных городах частично присутствуют названия улиц, информация о запретах проезда не учитывается.
Добавлена база данных: 120 камер-радаров и 783 передвижных поста ГАИ/ДПС. За 400 метров Автоспутник выдаст визуальное и звуковое предупреждение.

[url=http://info.je1.ru/GPS_032.html]Подробнее...[/url]

Anonymous said...

У нас в жж за такой пост бы закидали какашками в каментах:)

Anonymous said...

Мульти портал. Есть все, почти всё. Немного из навигации сайта.

[url=http://pi7.ru/video/]Видео для взрослых[/url]
--------------------------------------- |
Анекдотик, не помешает... :)
Она и он. Она:
- Хочу [url=http://pi7.ru]секса[/url]... Ну очень хочу! На 2 часа не меньше! Вот ты можешь два часа?
- Ну конечно могу!
- А можно нескромный вопрос... Ты будешь во время [url=http://pi7.ru]секса[/url] кричать?
- Да, от ужаса...
- Почему?
- Потому, что я уже всё, а до конца секса ещё 1 час 50 минут!

блуждала по сети , [URL=http://pi7.ru][IMG]http://pi7.ru/12.gif[/IMG][/URL]

Anonymous said...

Подскажите, а у вас сквозную ссылку купить можно? Если да, сообщите цену на мыло, пожалуйста?

Anonymous said...

Кино http://www.film-book.ru

Anonymous said...

Хорошая статья. Действительно было интересно почитать. Не часто такое и встречается та.Наверное стоит подписаться на ваше RSS

Anonymous said...

overdosing by smoking tobacco [url=http://usadrugstoretoday.com/products/stress-relief.htm]stress relief[/url] the national center for posttraumatic stress disorder http://usadrugstoretoday.com/products/zofran.htm dental adenoma on jaw http://usadrugstoretoday.com/products/ed-discount-pack-3.htm
city on a diet [url=http://usadrugstoretoday.com/categories/antibiotics.htm]antibiotics[/url] orgasm spankwire [url=http://usadrugstoretoday.com/categories/stop-smoking.htm]can stress change your emotions[/url]

Anonymous said...

http://meen.in/fluocinolone/what-is-fluocinolone-acetonide-tropical-solution-used-for
[url=http://meen.in/erythromycin/erythromycin-vs-retin-a-micro]viagra find online pages edinburgh free[/url] buy viagra in the uk [url=http://meen.in/escitalopram/escitalopram-no-prescription]escitalopram no prescription[/url]
pharmacy schools and data http://meen.in/fluocinolone/fluocinolone-acetonide-cream
[url=http://meen.in/escitalopram/citalopram-escitalopram-uk]cialis generic pharmacy[/url] vitamins and herbs for erectile dysfunction [url=http://meen.in/felodipine/felodipine]felodipine[/url]
drug lipitor prescription http://meen.in/cleocin/do-not-lie-down-for-at-least-30-minutes-cleocin
[url=http://meen.in/ezetimibe/virgil-brown-ezetimibe-2008]lenox pharmacy massachusetts[/url] ramipril drug interactions [url=http://meen.in/flonase/effect-flonase-side]effect flonase side[/url] addicted to drugs [url=http://meen.in/erection/spheric-tank-erection]spheric tank erection[/url]

Anonymous said...

travel frames http://livetravel.in/lufthansa/which-is-better-airbus-boeing travel study services
[url=http://livetravel.in/inn/howard-johnson-inn-kissimmee-maingate-east]how is river travel[/url] canadian travel to us [url=http://livetravel.in/tours/monmouthshire-tours]monmouthshire tours[/url]
best travel websites flights http://livetravel.in/tourist/perpetual-tourist
[url=http://livetravel.in/tour/north-italian-lakes-tour]small travel pouches[/url] travel brochure template [url=http://livetravel.in/expedia/expedia-car-rental]expedia car rental[/url]
cheapest time to travel to paraguay http://livetravel.in/plane-tickets/cheap-plane-tickets-discount-travel-online-reserva
[url=http://livetravel.in/expedia/discount-travel-online-booking-cheap-airfare-expedia-flights]travel fitness equipment[/url] adult diapers travel [url=http://livetravel.in/inn/comfort-inn-calgary]comfort inn calgary[/url] sato travel airline tickets [url=http://livetravel.in/airlines/continental-airlines-incoming-flight-information]continental airlines incoming flight information[/url]
travel from buenos aires to iquazzu [url=http://livetravel.in/airline/airline-cheap-international-ticket-travel]airline cheap international ticket travel[/url]
travel about lightweight stroller http://livetravel.in/inn/holiday-inn-express-hotel-and-suites-seabrook-tx
[url=http://livetravel.in/vacation-packages/vacation-package-harrahs-new-orleans]first aid kit and travel[/url] vaccinations for travel to india fco [url=http://livetravel.in/tourist/colorado-tourist-garden-of-the-gods]colorado tourist garden of the gods[/url]
[url=http://livetravel.in/travel/long-travel-suspension]long travel suspension[/url] alaska air travel [url=http://livetravel.in/adventure/bookworm-adventure-tips]bookworm adventure tips[/url] arc benefitsn as travel agent [url=http://livetravel.in/vacation-packages/hanalei-bay-resort-car-package-vacation]hanalei bay resort car package vacation[/url]
last minute travel deals by departure [url=http://livetravel.in/vacation-packages/puerto-rico-vacation-package-htm]puerto rico vacation package htm[/url]

Anonymous said...

calvin klein totebag http://topcitystyle.com/xl-button-down-tops-shirts-size6.html australia fashions [url=http://topcitystyle.com/44-pants-size26.html]fashion knitting[/url] kelly likes shoes
http://topcitystyle.com/navy-blue-off-white-dolce-amp-gabbana-color25.html cute boy toddler clothes [url=http://topcitystyle.com/on-sale-page21.html]south korea shoes[/url]

Anonymous said...

slutclothes http://topcitystyle.com/christian-audigier-tunic-brand106.html italian mens shoes [url=http://topcitystyle.com/red-white-men-color120.html]emily deschanel nude[/url] teen french fashion
http://topcitystyle.com/?action=products&product_id=2025 msypace fashion layouts [url=http://topcitystyle.com/women-page43.html]designer ipod cases[/url]

Anonymous said...

nicole mason sex porn forums http://theporncollection.in/orgasm/hard-core-orgasm
[url=http://theporncollection.in/orgy/homemade-amateur-orgy]global porn[/url] ruptured anal gland dog [url=http://theporncollection.in/hentai-porn/amy-hentai]amy hentai[/url]
japan adult movie http://theporncollection.in/free-hentai/su-kaolla-hentai
[url=http://theporncollection.in/gay-xxx/x-demon-gay-cigarette-smoking-fetish]lexi belle dildo[/url] adult flag football [url=http://theporncollection.in/gay-movie/anti-gay-marriega]anti gay marriega[/url]
adult art classes oswego ny http://theporncollection.in/hentai-porn/kenshin-doujinshi-scans-hentai
[url=http://theporncollection.in/gay-video/medical-fetish-pictures-gay]watch free hentai videos online[/url] teens try anal [url=http://theporncollection.in/mature-xxx/mature-housewife-movies]mature housewife movies[/url]
coulpe porn http://theporncollection.in/porn-galleries/porn-star-working-for-fox
[url=http://theporncollection.in/lesbian-xxx/lesbian-communities]avril lavenge porn[/url] real free porn videos [url=http://theporncollection.in/hentai-sex/streaming-hentai-vids]streaming hentai vids[/url]

Anonymous said...

хорошая статья, побольше таких писать! Автору респект

Anonymous said...

хорошая статья, побольше таких писать! Автору респект

Anonymous said...

disney movie princess enchanted tales follow your dreams jpeg [url=http://worldmovs.co.cc/full_version-hitman/9175database/]Hitman[/url] little mermaid movie [url=http://worldmovs.co.cc/full_version-kill-buljo-the-movie/4467database/]Kill Buljo The Movie[/url]
animals movie utah [url=http://worldmovs.co.cc/full_version-run-fat-boy-run/11253database/]Run Fat Boy Run[/url] the former mustang drive in in al in a movie [url=http://full-length-movies.com/dvd-quality-movie-freddy-vs-jason/28809database/]Freddy Vs Jason[/url]
tenacious d movie trailer [url=http://worldmovs.co.cc/full_version-legally-blonde/14652database/]Legally Blonde[/url] disney movie cars [url=http://full-length-movies.com/dvd-quality-movie-mama-s-boy/16491database/]Mama's Boy[/url]
movie clips of pamela anderson [url=http://full-length-movies.com/dvd-quality-movie-el-arcangel/13819database/]El Arcangel[/url] sex movie gallaries [url=http://worldmovs.co.cc/full_version-manolito-gafotas/17570database/]Manolito Gafotas[/url]

Anonymous said...

guga kuerten clothes http://www.thefashionhouse.us/brown-hoodies-color12.html domnatricksshoes [url=http://www.thefashionhouse.us/?action=products&product_id=2271]easy spirit amerigo shoes[/url] hiking shoes with arch support
http://www.thefashionhouse.us/roberto-cavalli-men-brand7.html clear wedding shoes [url=http://www.thefashionhouse.us/?action=products&product_id=2423]best shoes for plantar fashiitis[/url]

Anonymous said...

health care 2020 corning [url=http://usadrugstoretoday.com/products/arimidex.htm]arimidex[/url] teeth stain and antibiotics http://usadrugstoretoday.com/products/requip.htm
free online drug reference book [url=http://usadrugstoretoday.com/categories/antidepressivum---anti-angst.htm]antidepressivum anti angst[/url] health policy decisions value based [url=http://usadrugstoretoday.com/products/requip.htm ]quick review of pharmacy [/url] antibiotics sheep
internet pharmacy sales in pa [url=http://usadrugstoretoday.com/products/kamasutra-ribbed-condoms.htm]kamasutra ribbed condoms[/url] red gold the epic story of blood http://usadrugstoretoday.com/products/zofran.htm
anti aging drugs [url=http://usadrugstoretoday.com/categories/artritis.htm]artritis[/url] costo pharmacy [url=http://usadrugstoretoday.com/categories/weibliche-verstarkung.htm ]purchase stanozolol pharmacy rx on line [/url] viagra cialis generic

Anonymous said...

harry potter movie 6 [url=http://moviestrawberry.com/films/film_men_of_war/]men of war[/url] gossip girls movie http://moviestrawberry.com/films/film_gone/ the great dictator movie
the movie gameplan [url=http://moviestrawberry.com/films/film_the_pacific_and_eddy/]the pacific and eddy[/url] cameos in across the universe movie http://moviestrawberry.com/films/film_the_wings_of_the_dove/ anime download free movie
adult movie gallaries [url=http://moviestrawberry.com/films/film_the_self_destruction_of_the_ultimate_warrior/]the self destruction of the ultimate warrior[/url] pulse movie
bikini bistro movie trailer [url=http://moviestrawberry.com/films/film_winter_of_frozen_dreams/]winter of frozen dreams[/url] camden maine movie theater http://moviestrawberry.com/films/film_repli_kate/ movie nightmare
aim movie help [url=http://moviestrawberry.com/films/film_invincible_70/]invincible 70[/url] movie facts http://moviestrawberry.com/films/film_ghost_lake/ download movie onto final cut pro

Anonymous said...

dog hotel hershey hotel, reserve hotel, hotel 81, cheap chicago hotel hotel weddings hotel co.uk, hotel ratings, hotel and motel, maldron hotel, 7 star hotel obbah hotel cocca hotel, reserve hotel room, sun bright hotel, hotel free port viagra sale cheap generic viagra, viagra 100mg, generic viagra online housing stimulus bill economy class h, cheap hotels la, find accommodation, staffordshire housing

Anonymous said...

example rooms
[url=http://vimeo.com/user4498961]cheap hotel websites
[/url]booking class
hotels search
tiffany figure hostelry
[url=http://www.earthday.org/users/48490]cheap rates for hotels
[/url]pensione bed
grant-in-aid reasonable
kenya airways online booking
[url=http://www.fairview.org/cty/members/klemot/default.aspx]find hotel prices
[/url]booking of hotel
cut-price ps3
lousy houses america
[url=http://www.youthcabinet.org/profile/Josh]hotel price bot
[/url]agile phones deals
bed prices from
tinpot hotels near disneyland
[url=http://www.beautyresearch.com/blogs/alexa/archive/2010/08/15/hotels-and-accomodations.aspx]maldron hotel
[/url]right to bribe
asiana airlines saving class
levico terme
[url=http://www.mazdacommunity.com/profiles/blogs/special-hotel-offers-or]cheap niagara falls hotels
[/url]at house in spain
catalyst housing
carefree booking

Anonymous said...

hi every person,

I identified marcoramilli.blogspot.com after previous months and I'm very excited much to commence participating. I are basically lurking for the last month but figured I would be joining and sign up.

I am from Spain so please forgave my speaking english[url=http://thehottesttopicsfo.info/].[/url][url=http://palatesttrends.info/forum].[/url][url=http://sportsnewste.info/].[/url]