PHP File-Upload $GLOBALS Overwrite Vulnerability

Credit: Stefan Esser
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project -= Security Advisory =- Advisory: PHP File-Upload $GLOBALS Overwrite Vulnerability Release Date: 2005/10/31 Last Modified: 2005/10/31 Author: Stefan Esser [sesser (at) hardened-php (dot) net [email concealed]] Application: PHP4 <= 4.4.0 PHP5 <= 5.0.5 Severity: $GLOBALS overwrite can lead to unexpected behaviour of PHP applications, which can lead to execution of remote PHP code in many situations Risk: Critical Vendor Status: Vendor has released a bugfixed PHP 4 version References: Overview: PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. During the development of the Hardening-Patch which adds security hardening features to the PHP codebase, several vulnerabilities within PHP were discovered. This advisory describes one of these flaws concerning a weakness in the file upload code, that allows overwriting the GLOBALS array when register_globals is turned on. Overwriting this array can lead to unexpected security holes in code assumed secure. This vulnerability has consequences for a lot of PHP applications f.e. everything based on PEAR.php and vBulletin. And can lead to remote PHP code execution. For a detailed explanation of the $GLOBALS overwrite problem, have a look at the following article which describes it in more detail: Details: In PHP 4.3.11 some code was added to disallow overwriting the $GLOBALS array when register_globals is turned on. Unfortunately there was a hole in this protection. The introduced code did only affect the globalisation of the GET, POST and COOKIE variables. However it was overseen, that the rfc1867 file upload code within PHP also registers global variables, which can be used by an attacker to overwrite the $GLOBALS array by simply sending a multipart/form-data POST request containing a fileupload field with the name 'GLOBALS'. Until now it was not realised, how dangerous the problem is. This is also one of the reasons why all PHP <= 4.3.10 packages shipped with various distributions are still vulnerable to the normal $GLOBALS overwrite, which was fixed in PHP 4.3.11. Describing the impact of $GLOBALS overwrite vulnerabilities and why it does not only affect installations, where register_globals is turned on, why it allows remote code execution in a lot of PHP applications and why this is also a threat for applications that allow local file includes and are running in a SAFE_MODE or open_basedir environment is out of the scope of this advisory. The interested reader is advised to read the following article, that describes this "new" bugclass a bit more detailed, with examples. Finally it should be noted that users of our Hardening-Patch for PHP are not affected if they run the at least version from September. Proof of Concept: The Hardened-PHP project is not going to release exploits for any of these vulnerabilities to the public. Recommendation: It is strongly recommended to upgrade to the new PHP-Releases as soon as possible, because the GLOBALS problem is very dangerous to a lot of PHP applications in the wild. Especially because writing a worm that f.e. uses this problem to exploit everything based on PEAR.php is very simple. Additionally we always recommend to run PHP with the Hardening-Patch applied, especially because it offers even more protection against $GLOBALS overwrites than the default PHP. GPG-Key: pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1 Copyright 2005 Stefan Esser. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see iD8DBQFDZh0fRDkUzAqGSqERAo5yAJ0fNc8IZKgAdhGf7VkuzcubwN0+2ACfWK8K IZXWzIMzQMf2DEc2ktRgOHQ= =X87Q -----END PGP SIGNATURE-----

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023,


Back to Top