Introduction
to
Web Security

 


Code Immersion Day
Fri 03 Aug 2018
A "bit" more about myself
The digital age
Being Paranoid
  • Validate input
  • Filter output
  • Robustness principle - Be conservative in what you send, be liberal in what you accept
Filter output
Validate input
  • 22 Dec 2016: CVE-2016-10033
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10033
  • The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
  • Demo
Validate input - vulnerability
  • setFrom
  • validateAddress
  • mailSend
  • $params = sprintf('-f%s', $this->Sender);
$params:
-f"evil\" -oQ/tmp/ -X/var/www/html/asg1/demo/footer.php sender"@vulnerable.com

// This will cause sendmail to execute with (other options omitted for brevity):
Arg no. 0 = [/usr/sbin/sendmail] // binary
Arg no. 1 = [-fevil\] // set sender name
Arg no. 2 = [-oQ/tmp/] // set queue group
Arg no. 3 = [-X/var/www/html/cs4239-asg1-patch/footer.php] // path of log file
Arg no. 4 = [-sender"@vulnerable.com] // invalid option
Validate input - patch
  • Compare v5.2.17 and v5.2.18
  • $params = sprintf('-f%s', escapeshellarg($this->Sender));
$params: // note the single quotes
-f'"evil\" -oQ/tmp/ -X/var/www/html/cs4239-asg1-patch/footer.php sender"@vulnerable.com'

// This will cause sendmail to execute with (other options omitted for brevity):
Arg no. 0 = [/usr/sbin/sendmail]
Arg no. 1 = [-f"evil\" -oQ/tmp/ -X/var/www/html/cs4239-asg1-patch/footer.php sender"@vulnerable.com] // valid email local-part within quotes
  • Demo
Validate input - bypass