Directory traversal attacks occur when your program reads or writes a file where the name is based on some sort of input that can be maliciously tampered with. When used in conjunction with log poisoning this can lead to an attacker gaining remote shell access to your server.
At the most simple it could be to include a file like this:
echo file_get_contents($_GET['sidebar']);
The intention would be for you to be able to call your URL and send a parameter indicating which sidebar content you want to load... like this: http://foo.bar/myfile.php?sidebar=adverts.html
Which is really terrible practice and would not be done by any experienced developer.
Another common place where directory traversal attacks can occur is in displaying content based on a database call.
If you are reading from or writing to a file based on some input (like GET, POST, COOKIE, etc) then make sure that you remove paths. The PHP function basename will strip out paths and make sure that you are left only with a filename.
This is still not foolproof, however, as an attacker would still be able to read files in the same directory.
A safer way to do it is to whitelist the files that are allowed to be included. Whitelisting is safer than blacklisting, so instead of trying to exclude all malicious combinations we will rather allow only a set of safe options to be used.
Consider the following code as an alternative to the above:
$page = $_GET['page'];
$allowedPages = array('adverts','contacts','information');
if ( in_array($page, $allowedPages) )
{
echo file_get_contents(basename($page . '.html'));
}
You should consider configuring PHP to disallow opening remote urls with the file stream wrapper by setting allow_url_fopen to Off in your php.ini file. This does mean that you can't use any function that relies on the file stream (like file_get_contents) to read a URL (you'll need to use curl instead) but it does prevent an attacker from including their own code into your site.
On a system configuration scale it's ideal to have each site running in a chroot jail. By locking down access to the user that your webserver runs under to a specific directory you can limit the impact of a traversal attack.
So in summary:
At the most simple it could be to include a file like this:
echo file_get_contents($_GET['sidebar']);
The intention would be for you to be able to call your URL and send a parameter indicating which sidebar content you want to load... like this: http://foo.bar/myfile.php?sidebar=adverts.html
Which is really terrible practice and would not be done by any experienced developer.
Another common place where directory traversal attacks can occur is in displaying content based on a database call.
If you are reading from or writing to a file based on some input (like GET, POST, COOKIE, etc) then make sure that you remove paths. The PHP function basename will strip out paths and make sure that you are left only with a filename.
This is still not foolproof, however, as an attacker would still be able to read files in the same directory.
A safer way to do it is to whitelist the files that are allowed to be included. Whitelisting is safer than blacklisting, so instead of trying to exclude all malicious combinations we will rather allow only a set of safe options to be used.
Consider the following code as an alternative to the above:
$page = $_GET['page'];
$allowedPages = array('adverts','contacts','information');
if ( in_array($page, $allowedPages) )
{
echo file_get_contents(basename($page . '.html'));
}
You should consider configuring PHP to disallow opening remote urls with the file stream wrapper by setting allow_url_fopen to Off in your php.ini file. This does mean that you can't use any function that relies on the file stream (like file_get_contents) to read a URL (you'll need to use curl instead) but it does prevent an attacker from including their own code into your site.
On a system configuration scale it's ideal to have each site running in a chroot jail. By locking down access to the user that your webserver runs under to a specific directory you can limit the impact of a traversal attack.
So in summary:
- Use basename() on any variable you use to include a file
- Set allow_url_fopen PHP setting to Off
- Set a whitelist of files that you allow to be included
Comments
Post a Comment