Secure PHP Coding - Part 2

Types of Security Vulnerabilities
1. Remote File Inclusion (RFI)
2. Local File Inclusion (LFI)
3. Local File Disclosure/Download
4. Remote File Upload
5. Remote Command Execution
6. Remote Code Execution (RCE)
7. Authentication Bypass/Insecure Permissions
8. Cross Site Scripting (XSS)
9. Cross Site Request Forgery (CSRF)

Remote Code Execution – Vulnerable Codes
Evaluating eval()
<?php
$title = $_GET['title'];
eval('echo Welcome '.$title.';');
// assert() also vulnerable
?>
Regular Expression
<?php
$string = $_GET['string'];
print preg_replace('/^(.*)/e', 'strtoupper(1)', $string);
?>
Attack
http://localhost/rce/to_upper.php?string=phpinfo()
Attack
http://localhost/rce/display_title.php?title=vinoth;phpinfo();
Expected Input
Expected Input
http://localhost/rce/display_title.php?title=vinoth
http://localhost/rce/to_upper.php?string=lowerstring

Dynamic Variables
<?php
foreach ($_GET as $key => $value) {
$$key = $value;
}
//extract($_GET);
//parse_str($_GET);
function isLoggedIn(){
return $_SESSION['isLoggedIn'];
}
if (isLoggedIn()) {
echo "You are logged in :)";
}
else{
echo "you are not logged in :("; die();
}
?>
Attack
http://localhost/rce/user.php?_SESSION[isLoggedIn]=true
Expected Input
http://localhost/rce/user.php?name=vinoth

Dynamic Functions
<?php
$callback = $_GET['callback'];
$arguments = $_GET['arguments'];
function callback($args){
echo 'function called with arguments';
}
$callback($arguments);
// $func = new ReflectionFunction($callback); $func->invoke($arguments); also same
// create_function also vulnerable create_function('$foobar', "echo $foobar;");
?>
Attack
http://localhost/rce/callback.php?callback=phpinfo&arguments=1
Expected Input
http://localhost/rce/callback.php?callback=callback&arguments=args

Remote Code Execution – Fix
• Don't allow any special character like "(",")","``"&";" etc
• Never create ($$, extract & parse_str()) dynamic variables from
$_POST, $_GET or $_REQUEST
• Validate callback with array of allowed callback
<?php
$callbacks = array('callback', 'another_callback');
$callback = $_GET['callback'];
$arguments = $_GET['arguments'];
function callback($args){
echo 'function called with arguments';
}
if (in_array($callback, $callbacks)) {
$callback($arguments);
}
?>
callback_fixed.php
<?php
$title = preg_replace("/[^A-Za-z0-9_]/","",$_GET['title']);
eval('echo Welcome'.$title.';');
?>
display_title_fixed.php
to_upper_fixed.php
<?php
$string = $_GET['string'];
print preg_replace('/^(.*)/e', 'strtoupper("1")', $string);
?>

Remote Code Execution – Functions
• eval
• Assert
• preg_replace // with /e in regex
• create_function
• functions with callbacks for example (array_map, usort, ob_start &
preg_replace_callback etc)
• $$, extract & parse_str with one parameter
• dynamic function
• ReflectionFunction
• unserialize

Authentication Bypass/Insecure Permissions

Authentication Bypass – Vulnerable Scenarios
• Validation of user permissions in View Page & missing user validation
in handler page
• Improper validation of id parameter
index.php
<?php include 'util.php';
if (!isLoggedIn()) {
echo 'Not Authorized'; die();
} ?>
<!DOCTYPE html>
<html>
<body>
<p>Welcome Admin</p>
<form action="handler" method="post">
<input type="text" name="user_id">
<input type="hidden" name="type" value="delete_user">
<input type="submit" value="Delete User" name="submit">
</form>
</body>
</html>
<?php
$type = $_REQUEST['type'];
switch ($type) {
case 'delete_user':
$user_id = $_REQUEST['user_id'];
// delete user
echo "user deleted successfully :)";
break;
default:
break;
} ?>
handler.php
Attack
•http://localhost/auth/handler.php?user_id=1&type=delete_user

Authentication Bypass – Fix
• add proper user validation :p
<?php
include 'util.php';
if (!isLoggedIn()) {
echo 'Not Authorized';
die();
}
$type = $_REQUEST['type'];
switch ($type) {
case 'delete_user':
$user_id = $_REQUEST['user_id'];
// check $user_id == $_user->user_id
// delete user
echo "user deleted successfully :)";
break;
default:
break;
} ?>
handler_fixed.php

Cross Site Scripting (XSS) – Vulnerable Code
search.php
<?php
$query = $_GET['q'];
$user_id = $_GET['user_id'];
echo "You searched for ".$query;
?>
<br>
<script type="text/javascript">
var user = '<?php echo $user_id?>';
</script>
http://localhost/xss/search.php?user_id=1%27;alert(1);//&q=test
http://localhost/xss/search.php?user_id=1q=<script>alert(1)</script>
Attack
http://localhost/xss/search.php?user_id=1&q=9 dragon chinese
Expected Input

Cross Site Scripting (XSS) – Fix
• filter user inputs
• use htmlspecialchars,htmlentities,strip_tags,filter_var & is_numeric
search_fixed.php
<?php
$query = htmlspecialchars($_GET['q'], ENT_QUOTES, 'UTF-8');
$user_id = filter_var($_GET['user_id'], FILTER_VALIDATE_INT);
echo "You searched for ".$query;
?>
<script type="text/javascript">
var user = '<?php echo $user_id ?>'; </script>

Cross Site Scripting (XSS) – Functions
• print
• echo
• printf
• sprintf
• var_dump
• print_r

Cross Site Request Forgery (CSRF)

Cross Site Request Forgery – Vulnerable Code
• Missing CSRF token in post data
• Using $_GET or $_REQUEST instead of $_POST in data update
Vulnerable Scenario
update_user.php
<?php
$name = $_REQUEST['name'];
$about = $_REQUEST['about'];
$username = $_REQUEST['username'];
// update user info
?>
attck.html
<!DOCTYPE html>
<html>
<body>
<img src="http://localhost/csrf/update_user.php?name=YouHaveBeenHackedByVinoth" alt="You Have Been Hacked :(" height="0" width="0"/>
</body>
</html>

Cross Site Request Forgery – Fix
<?php
$name = $_POST['name'];
$about = $_POST['about'];
$username = $_POST['username'];
if($_SESSION['csrf_token'] != $_POST['csrf_token']){
echo 'Wrong Token';
}
// update user info
?>
update_user_fixed.php
• avoid $_REQUEST and $_GET for getting post information
• use CSRF Token for post data

References
• https://github.com/vinothzomato/zpwned
• Information & Samples
• https://www.exploit-db.com/papers/12871/
• http://stackoverflow.com/questions/3115559/exploitable-php-
functions
• http://www.php-security.org/2010/05/20/mops-submission-07-our-
dynamic-php/index.html

Secure PHP Coding - Part 2

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Secure PHP Coding - Part 2

Similar to Secure PHP Coding - Part 2 (20)

Recently uploaded

Recently uploaded (20)

Secure PHP Coding - Part 2