[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: PHP and SCRIPT_NAME variable



Sorry, I forgot to insert the initial question, here is it:

Roman Medina-Heigl Hernandez wrote:
Hello,

Last week I was thinking about the possibility for an external attacker to
influence over the following PHP variable:
$_SERVER['SCRIPT_NAME']

The former variable contains the remote path (URI) to a PHP script, so if
for instance you access with a browser to:
http://<site>/aa/bb/cc/script.php
Then SCRIPT_NAME will contain "/aa/bb/cc/script.php"

I did some basic tests with PHP 4.3.10 and the implementation seems to be safe:
- For instance, if you access something like:
http://<site>/aa/bb/../dd/cc/script.php
Then SCRIPT_NAME will be "/aa/dd/cc/script.php"
instead of "/aa/bb/../dd/cc/script.php"
- If you try:
http://<site>/aa/bb/cc/script.php/something
or
http://<site>/aa/bb/cc/script.php?something
Then SCRIPT_NAME will contain "/aa/bb/cc/script.php"

My goal is to be able to add some attacker-specified string to the
variable. Two questions:
1) Do you know of any trick/method by which an attacker could alter
SCRIPT_NAME variable? (obviusly without having access to docroot directory
and/or edit httpd.conf)
2) Perhaps older PHP versions didn't sanitize SCRIPT_NAME variable
correctly and could be abused? Any idea?

TIA.

Cheers,
-Román

Regards,
Harald Eder


Serg Belokamen wrote::
Sorry I haven't been following the topic from the very beginning,
could someone please re-post the original question.

Thank you,
   Serg

On 21 Feb 2006 22:00:18 -0000, contact@xxxxxxxxxxxxxxx
<contact@xxxxxxxxxxxxxxx> wrote:
Hi,

as far as I know the elements of the $_SERVER array are filled by the webserver and therefore a manipulation through a php trick might by difficult.

From my opinion it will be easier to alter this values through a trick on the webserver for instance by using a bug in Apache but I do not know about any which might do this.

Anyway, its quite a interesting point of view because many php scripts use the $_SERVER['REMOTE_ADDR'] value for their session management und maybe some other array items too.

But it would be also quite interesting if php uses the items of this array to do something or if its just an array with no effect for the php scripts. Does anybody know more about this?