## Summary: The application has a proxy.php file which basically accepts a parameter via `url` query parameter and passes it to `fopen()`. However, it doesn't validate the parameter value prior to passing it to `fopen`- making it possible to influence what's being done. That said, because of code following the `fopen`, it throws error with `filesize()`. Yet, we can still send requests to any arbitrary URL and confirm the existence of files in the system. ## Steps To Reproduce: For easier reproduction, let's just confirm the existence of a file; Open https://infodesk.engelvoelkers.com/proxy.php?url=proxy. You should receive the following warning message; > fopen(proxy): failed to open stream: No such file or directory in /var/www/html/proxy.php on line 3 Now, open https://infodesk.engelvoelkers.com/proxy.php?url=proxy.php which we know exists and as such, it passes the `fopen` check and goes on to next line (i.e. 4) and gives another warning, confirming the existence of the file; > filesize() expects parameter 1 to be a valid path, resource given in /var/www/html/proxy.php on line 4
Similarly, we can send arbitrary requests to external as well as internal URL with `http` URL Scheme. It may be possible to use other schemes like `gopher://` to exfiltrate contents or send emails with SMTP which I haven't tested yet. The response also returns the HTTP status of the requested endpoint. So, we can basically determine response status as well. For example, opening https://infodesk.engelvoelkers.com/proxy.php?url=http://cm2.pw/xxx would give the following warning; > fopen(http://cm2.pw/xxx): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /var/www/html/proxy.php on line 3 ## Supporting Material/References: {F1105547} {F1105548} ## Impact - Internal hosts and service enumeration is possible at minimum. - Confirm the existence of file within the system and its filepath It might be possible to exfiltrate contents with other URL scheme like `gopher` or send emails with SMTP. Or it could be possible to bypass `filesize` altogether which I'm yet to explore.