[PHP-DEV] Proposal: restrict the number of filters

Mailing Lists php.internals
1

Hello,

Chaining filters is becoming an increasingly popular primitive to
exploit PHP applications:

-

+ GitHub - synacktiv/php_filter_chain_generator
-
PHP filter chains: file read from error-based oracle
+ GitHub - synacktiv/php_filter_chains_oracle_exploit: A CLI to exploit parameters vulnerable to PHP filter chain error based oracle.
- Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix +
GitHub - ambionics/wrapwrap: Generates a `php://filter` chain that adds a prefix and a suffix to the contents of a file.
- Introducing lightyear: a new way to dump PHP files +
GitHub - ambionics/lightyear: lightyear is a tool to dump files in tedious (blind) conditions using PHP filters

They provide increasingly powerful primitives ranging from arbitrary
file read to arbitrary code execution, and are tedious to protect
against, as filters can be used in a lot of places.

The easiest way to kill this vector is to simply limit the number of
filters that can be chained, as attacks require a at least a couple of
them, while legitimate use usually use one or two tops, as highlighted
by arnaud-lb's analysis:

I sent a pull-request to implement this:

What do y'all think about this?

--
Julien (jvoisin) Voisin
GPG: 04D041E8171901CC
dustri.org

2

On Thu, 7 Nov 2024, jvoisin wrote:

The easiest way to kill this vector is to simply limit the number of
filters that can be chained, as attacks require a at least a couple of
them, while legitimate use usually use one or two tops, as highlighted
by arnaud-lb's analysis:
Limit the number of filters by jvoisin · Pull Request #16699 · php/php-src · GitHub

I sent a pull-request to implement this:
Limit the number of filters by jvoisin · Pull Request #16699 · php/php-src · GitHub

What do y'all think about this?

I am not a fan of hardcoding arbitrary limits, or having an ini setting
for such a limit. I especially think that the suggested limit of 5, or
even 3, is not a good idea.

The example that the issue links to to fix a vulnaribility in is:

  include $_GET['page'];

Which is... yeah.

cheers,
Derick

--
https://derickrethans.nl | https://xdebug.org | https://dram.io

Author of Xdebug. Like it? Consider supporting me: Xdebug: Support

mastodon: @derickr@phpc.social @xdebug@phpc.social