Re: [cobalt-users] Raq3 && PHP4.0.4pl1 => BIG SECURITY HOLE

[Ted Behling <TBehling@xxxxxxxxxxxxx>]

At 06:58 AM 9/14/01, Glen Scott wrote:
> > Some of our customers started complaining lately about the fact that onces
> > they uploaded files through PHP and used the "move_uploaded_file" function
> > of php the rights of the uploaded file would look like this.
> >
> > -rw-------   1 httpd    root           66 Sep 13 15:53
> > /home/sites/home/web/tmp/test.file
> >
> > Which is off course a huge security hole !!!
>
> Why is this a security hole?  As far as I can see, the file can only be 
> read and written to by the user 'httpd'.  Isn't the group in this case 
> irrelevant?

This is a problem because when PHP is used as an Apache module, it runs in 
the security context of the Web server.  Therefore, uploaded files are 
owned by the 'httpd' user.  Since all users on the server run their PHP 
scripts in the same security context, they all have access to each other's 
files.  A different user could easily write a PHP script that recurses 
through your disk and deletes every file it comes across to which it has 
access (i.e., owned by 'httpd').  BTW, this also applies to mod_perl.

This has been a known issue since day one.  To get around it, you have a 
couple of options.   You can run your uploading PHP scripts using the CGI 
version of PHP, under cgiwrap.  That'll run the script in the context of 
the PHP CGI owner.  Another, better option is to create a small setuid 
script, owned by the uploading user, to copy the uploaded file to a file 
owned by that user.  The script would execute this external program, then 
delete the original file.

--------------------------------------------------------------------------
Ted Behling, Web Application Developer - Monarch Information Systems, Inc.

43 Folly Field Road, Unit 4, Hilton Head Island, SC 29928-5434
E-mail: mailto:TBehling@xxxxxxxxxxxxx
Phone/Fax: 1-800-842-7894    Local or Outside the USA: 1-843-842-7894
Cell Phone (urgent issues): 843-816-7895
Cell Phone E-mail: mailto:TedPhone@xxxxxxxxxxxxx (116 letter limit)
Web site: http://www.MonarchIS.net
--------------------------------------------------------------------------