Part 2: PHP Security Mini Guide – Directory Traversal & Code Injection

Directory Traversal

Directory Traversal refers to the attack in which an authenticated or unauthenticated user can request and view or execute files which reside outside the root directory of a web application, or outside a directory in which they should be restricted to. This results in an attacker being able to read any file which the user running the webserver (commonly www-data) has access to. If a server has misconfigured file permissions (very common), then this attack can be further escalated.

In the following example the script passes an unavalidated/unsanitized value directly to the include() function. This means that the script will try to include whatever path/filename is passed as a parameter:

Insecure code sample:

$file = $_GET['file'];
include($file);

For example, passing /etc/passwd which is a file readable by all the users returns the content of the file which contains information of all users on the system:

PHP Security

This vulnerability can be mitigated in different ways depending on the case. However the most common and generic way to do it is by using the basename() and realpath() functions.

The basename() function returns only the filename in a given path/filename:

Input: ../../../etc/passwd
Output: passwd

The realname() function returns the canonicalized absolute pathname, only if the file exists and if the running script has executable permissions on all directories in the hierarchy.

Input: ../../../etc/passwd
Output: /etc/passwd

Secure code sample:

$file = basename(realpath($_GET['file']));
include($file);

Now when we request the same file we get an empty response:

PHP security

Avoid blacklisting

Blacklisting is often a bad practice simply because there are more than one ways to make the same request and hackers will always find ways to bypass restrictions. For example ../../../etc/ can also be written as ..%2F..%2F..%2Fetc%2F. If you need to specify access to specific files use a whitelist.

Code Injection/Execution

In this vulnerability an attacker maliciously takes advantage of a script which contains system functions/calls, to read or execute files on a remote server. This is synonymous to having a backdoor shell. Needless to say that under certain circumstances privilege escalation is possible.

In this example a script is using the exec() function to execute the ping command. However, the host is dynamic as it is being passed via an HTTP GET request:

Insecure code sample:

exec("ping -c 4 " . $_GET['host'], $output);
echo "<pre>";
print_r($output);
echo "</pre>";

Passing www.google.com as an example, returns the output of the ping command:

PHP Security

This is vulnerable to code injection as it allows the user to pass multiple commands to the function by simply using the “;” delimiter character which in linux can be used to execute multiple commands inline. For example, passing the following value “www.google.com;whoami” in the host parameter returns:

PHP Security

As we can see, the script executed both the ping and whoami command.

PHP has two functions, escapeshellarg() and escapeshellcmd(), which can help harden functions such as exec(), shell_exec(), passthru() and system().

escapeshellcmd() escapes any characters in a string that might be used to execute arbitrary commands. The following characters are escaped by preceding a backslash before them &#;`|*?~<>^()[]{}$\, \x0A and \xFF. Single and double quotes are escaped only if they are not paired.

Input: ping -c 4 www.google.com;ls -lah
Output: ping -c 4 www.google.com\;ls -lah

escapeshellarg() adds single quotes around a string and escapes any existing single quotes so that the entire string is being passed as a single argument to a shell command.

Secure code sample:

// #1 Restrict multiple commands
exec(escapeshellcmd("ping -c 4 " . $_GET['host']), $output);

// #2 Restrict multiple commands and multiple arguments
exec(escapeshellcmd("ping -c 4 " . escapeshellarg($_GET['host'])), $output);

The script does not execute the invalid input:

PHP Security

In addition to using these functions, a whitelist of accepted commands/arguments can be created. It should be noted that the escapeshellcmd() and escapeshellarg() functions might behave unpredictably on different Operating Systems, especially on Windows.

Unless it is necessary to keep, it is highly recommended to not use and disable these functions in PHP configurations to avoid security issues.