oss-sec mailing list archives
Re: CVE request: ruby file creation due in insertion of illegal NUL character
From: Tim <tim-security () sentinelchicken org>
Date: Wed, 17 Oct 2012 10:58:39 -0700
It's difficult to reason about whether this is a bug or a feature without knowing the justification for treating the Ruby version as a security vulnerability, which was not included in the announcement. One possible justification is this: suppose a webapp writes files with an attacker-controlled name to the web-server-visible /uploads/ directory, using this pseudocode: if (filename ends with .jpg) { open_for_writing(filename).write(content) } else { error "that's not a JPEG, go away" } and suppose that the web server also executes *.php files in that directory. Then an attacker could upload "evil.php\0.jpg", and browse to http://example.com/uploads/evil.php to get their payload executed. Is this what the Ruby people had in mind, or is there some other attack vector I'm not seeing?
I've personally exploited this condition in a number of PHP apps during pentests (in versions of PHP that don't prevent it). Is the application at fault for not doing a better job of data validation? Yes. Yet, is there any good reason to allow raw NUL bytes in file names? NO. As mentioned, no filesystem supports it. You can save the average web app user a lot of grief by just rejecting blatantly illegal paths. tim
Current thread:
- Re: CVE request: ruby file creation due in insertion of illegal NUL character, (continued)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Daniel Kahn Gillmor (Oct 16)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Fabian Keil (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Matthias Weckbecker (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Kurt Seifried (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Simon McVittie (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Kurt Seifried (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Matthias Weckbecker (Oct 18)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Simon McVittie (Oct 18)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Daniel Kahn Gillmor (Oct 16)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Simon McVittie (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Eitan Adler (Oct 17)
- Re: CVE request: ruby file creation due in insertion of illegal NUL character Tim (Oct 17)