Unsanitized input split

If input is being split and parsed based on an expected number of delimiters, it is trivial for an attacker to input an extra delimiter and, depending on the severity of the issue, execute code or engage in other mayhem.

Proof of concept

• PHP

<?php $username = $argv[1]; if ($username == "admin") { $username = $username . ":1"; } else { $username = $username . ":0"; } $username = split(":", $username); if($username[1] == "1") { echo "Is an admin\n"; } else { echo "Not an admin\n"; } ?>

Mitigation

In order to mitigate this attack, sanitize input before splitting. Be certain that there are no malicious delimeters. For example:

• PHP

<?php $username = str_replace(":", "", $argv[1]); if ($username == "admin") { $username = $username . ":1"; } else { $username = $username . ":0"; } $username = split(":", $username); if($username[1] == "1") { echo "Is an admin\n"; } else { echo "Not an admin\n"; } ?>