Revision as of 14:30, 6 May 2012

This is a programming language agnostic vulnerability, effecting any application which incorrectly uses string replacement to sanitize data.

Overview

Unsafe use of string replacement functions to sanitize user input is extremely common. Because string replacement (str_replace in PHP) functions only do a single replacement, it is necessary to loop over them until all unsafe characters or strings are removed if you are replacing more than a single character. This also applies to replacements powered by regular expressions.

Examples

PHP

A trivial example:

 
<?php
$filepath = $_GET['file'];
 
$safe_filepath = str_replace('../', '', $filepath);
 
echo("Safe filepath is '" . $safe_filepath . "'<br />");
include($safe_filepath);
?>
 

First an attacker may try a simple directory transversal attack, using '../' to escape. The result:

 Safe filepath is 'etc/passwd'

No dice, the dangerous string ('../') is dutifully sanitized by str_replace. But, our attacker isn't going to give up yet, now armed with the knowledge that '../' is being filtered out, he may try:

 test.php?file=....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd

The result:

 Safe filepath is '../../../../../../../../../../../etc/passwd'
 [contents of /etc/passwd]

Even if '../' is replaced twice, it can be easily bypassed by using ......///. No matter how many times the replacement is made, the attacker simply needs to nest another layer.

Other examples of unsafe uses of string replacement include:

 
str_replace('<?', '', $source);

 Bypassed by '<<??'

 
str_replace(array('<script', '<img'), '', $source);
 

 Bypassed by '<<imgscript>'

 
str_replace('file://', '', $source);
 

 Bypassed by 'file:/file:///'

PCRE

To test if perl compatible regular expressions are vulnerable to the attack, a small example perl script, rexpose.pl, is attached:

 
#!/usr/bin/perl
use strict;
use Getopt::Std;
 
my %opts = ();
getopts('s:p:',\%opts);
 
my $string  = $opts{s} if ($opts{s}) or usage();
my $pattern;
$pattern = $opts{p} if ($opts{p});
$pattern = '[.]{2}\/' unless (defined $pattern);
$string =~ s/$pattern//g;
print "$string\n";
 
 
 
sub usage
{
    print "rexpose.pl -s [string] [-p pattern]\n";
    print "Regex exposure will display string replacements using s/\$pattern//g.  Pattern defaults to '[.]{2}\\/' to match '../'.\n";
    exit(0);
}
 

• First, a check is performed to make sure that the string is being stripped at all to being with:

 [user@host ~]$ perl rexpose.pl -s ../../../../../../path/to/file
 path/to/file

• To identify if the replacement is vulnerable, a check using ....// in stead of ../ is performed:

 [user@host ~]$ perl rexpose.pl -s ....//....//....//....//....//....//path/to/file
 ../../../../../../path/to/file

Defense

If one must use str_replace for sensitization, it must be done using a loop or called recursively:

PHP

• Loop

 
function safe_str_replace($search, $replace, $subject) {
        while(strstr($subject, $search) !== FALSE) {
                $subject = str_replace($search, $replace, $subject);
        }
 
        return $subject;
}
 

• Recursion

 
function safe_str_replace($search, $replace, $subject) {
        if (strstr($subject, $search) !== FALSE) {
                return safe_str_replace($search,$replace,str_replace($search, $replace, $subject));
        }
        return $subject;
}
 

PCRE

• When patching rexpose.pl, line 12 contains the following line:

 
$string =~ s/$pattern//g;
 

• This can be fixed with a golfed until loop:

 
$string =~ s/$pattern//g until ($string !~ $pattern);
 

• This patch was tested:

 [user@host ~]$ perl rexpose.pl -s ....//....//....//....//....//....//path/to/file
 path/to/file

Whitelisting