5 ms·

In what world does this work? $ curl http://your-website.com/public/../../../../proc/12345/environ If your server is serving up your whole filesystem, you

In what world does this work? $ curl http://your-website.com/public/../../../../proc/12345/environ If your server is serving up your whole filesystem, you likely have a lot of big problems.

richwater 2y ago
You'd be surprised...
mlaux 2y ago
Typically seen more often as something like: http://example.com/viewPost.php?post=../../../whatever (where the server side code has the bug, not the web server configuration itself)
- hinkley 2y ago
  We got access logs like this all the time. SaaS app with separate domain per customer so we got a lot of probes like this. Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.
  - mschuster91 2y ago
    > Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car. This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.
  - Dylan16807 2y ago
    That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.
PaulDavisThe1st 2y ago
and even if your server can reach it, here (Debian 11), all of /proc/PID/environ is marked 0400, root:root owned.
miohtama 2y ago
Usually they work in PHP world
- Fidelix 2y ago
  what a nonsense notion... are you living in 1997?
  - hinkley 2y ago
    Last time I argued with someone about PHP was about 2014 and his app got hacked that evening. You’re being verrry generous with how long PHP has not sucked.
vundercind 2y ago
That specific example? If you’ve done an amazing bad job of configuring a web server. Similar examples that involve passing paths as e.g. query strings? When you’ve written an application that takes a real file path as a parameter and haven’t done any of several things that can prevent that from pointing to files you don’t want it to.
SoftTalker 2y ago
The world where ChatGPT configures your server?
sureglymop 2y ago
I recently found exactly this vulnerability in a non trivial php app that is pretty widely deployed.. I think it just slipped through.
Sohcahtoa82 2y ago
As an AppSec engineer and penetration tester... You'd be scared how often this works (Though not in the exact method you described). It might not even be a path traversal vulnerability [0] that lets you read files, it could be a shell injection [1] that allows you to `cat` the file. [0] https://en.wikipedia.org/wiki/Directory_traversal_attack https://en.wikipedia.org/wiki/Directory_traversal_attack [1] https://en.wikipedia.org/wiki/Code_injection#Shell_injection https://en.wikipedia.org/wiki/Code_injection#Shell_injection

In what world does this work? $ curl http://your-website.com/public/../../../../proc/12345/environ If your server is serving up your whole filesystem, you likely have a lot of big problems.

richwater 2y ago

You'd be surprised...

mlaux 2y ago

Typically seen more often as something like: http://example.com/viewPost.php?post=../../../whatever (where the server side code has the bug, not the web server configuration itself)

hinkley 2y ago
We got access logs like this all the time. SaaS app with separate domain per customer so we got a lot of probes like this. Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.
- mschuster91 2y ago
  > Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car. This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.
- Dylan16807 2y ago
  That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.

PaulDavisThe1st 2y ago

and even if your server can reach it, here (Debian 11), all of /proc/PID/environ is marked 0400, root:root owned.

miohtama 2y ago

Usually they work in PHP world

Fidelix 2y ago
what a nonsense notion... are you living in 1997?
- hinkley 2y ago
  Last time I argued with someone about PHP was about 2014 and his app got hacked that evening. You’re being verrry generous with how long PHP has not sucked.

vundercind 2y ago

That specific example? If you’ve done an amazing bad job of configuring a web server. Similar examples that involve passing paths as e.g. query strings? When you’ve written an application that takes a real file path as a parameter and haven’t done any of several things that can prevent that from pointing to files you don’t want it to.

SoftTalker 2y ago

The world where ChatGPT configures your server?

sureglymop 2y ago

I recently found exactly this vulnerability in a non trivial php app that is pretty widely deployed.. I think it just slipped through.

Sohcahtoa82 2y ago

As an AppSec engineer and penetration tester... You'd be scared how often this works (Though not in the exact method you described). It might not even be a path traversal vulnerability [0] that lets you read files, it could be a shell injection [1] that allows you to `cat` the file. [0] https://en.wikipedia.org/wiki/Directory_traversal_attack https://en.wikipedia.org/wiki/Directory_traversal_attack [1] https://en.wikipedia.org/wiki/Code_injection#Shell_injection https://en.wikipedia.org/wiki/Code_injection#Shell_injection