Full Disclosure mailing list archives
Re: file_exists() bypassing , critical problem ?
From: "Nourredine Himeur" <lostnoobs () security-challenge com>
Date: Mon, 2 Feb 2004 13:11:54 +0100
Nourredine Himeur wrote:There are various methods for securing file_exists() ...If you want to secure ... so that's unsecure , is'nt it ?I don't think that is critical problem.If it's not a problem Why you show us a methode to secure ? I think many programmers don't know this problem exists ! But there is too much hypocresy in php community to admit this vulnerability. The article : http://www.zend.com/zend/art/art-oertli.php don't talk about this sorry... Nourredine Himeur www.security-challenge.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.htmlI do not believe this is a security vulnerability. I would rather file it under "undefined behaviour"; it's odd, but not an immediate threat. One wonders if is_file()/is_dir() aren't more useful in this case. Having files that will be include()d in your GET/POST request is bad programming anyway. Jorrit Kronjee
Ok , so we can put the function file_exists() in dustbin... because everybody says : " One wonders if is_file()/is_dir() aren't more useful in this case. " " is bad programming anyway." " There are various methods for securing file_exists() " It's a bug , you can say "This is a script" PHP is a scripting language . CAN WE USE FILE_EXISTS() WITHOUT SECURE IT ? I'm sorry but for me it's really a Bug if file_exists("[anything]/../file.txt") is different as file_exists(./file.txt) and include("./[anything]/../file.txt") is same as include("./file.txt") or file("./[anything]/../file.txt") is same as file("./file.txt") or fpassthru("./[anything]/../file.txt") is same as fpassthru("./file.txt") JOKE : Dialogue between Me,file_exist(),include(),file() and fpassthru() ----------------------------------------------------- Nourredine Himeur : - Hi file_exists() file_exists() : - Hi Nourredine Himeur Nourredine Himeur: - how are you ? file_exists() : - Fine and you ? Nourredine Himeur : - Just one question - Is the file toto.txt exist ? file_exists() : - Yes Nourredine Himeur : - Ok ... but... - Is the file ./prout/../toto.txt exist ? file_exists() : - No Nourredine Himeur : - but include("./prout/../toto.txt") include the file toto.txt so it's exists ,isn't it ? file_exists() : - Sorry but we programming me for reqest No , I'm so stupid !!!! include() : - Yes you're so stupid ./lol/../toto.txt exist really file() : - Same thinks , I see ./foo/../toto.txt too. fpassthru() : - Same ! ----------------------------------------------------- ;-) Nourredine Himeur www.security-challenge.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- file_exists() bypassing , critical problem ? Lost Noobs (Feb 02)
- Re: file_exists() bypassing , critical problem ? m.esco (Feb 02)
- <Possible follow-ups>
- file_exists() bypassing , critical problem ? Nourredine Himeur (Feb 02)
- file_exists() bypassing , critical problem ? Nourredine Himeur (Feb 02)
- Re: Re: file_exists() bypassing , critical problem ? Nourredine Himeur (Feb 02)
- Re: Re: file_exists() bypassing , critical problem ? m.esco (Feb 02)
- Re: Re: file_exists() bypassing , critical problem ? Nourredine Himeur (Feb 02)
- Re: Re: file_exists() bypassing , critical problem ? Stefan Esser (Feb 02)
- Re: file_exists() bypassing , critical problem ? Daniel B (Feb 02)
- Re: Re: file_exists() bypassing , critical problem ? m.esco (Feb 02)
- Message not available
- Re: file_exists() bypassing , critical problem ? Nourredine Himeur (Feb 02)
- Re: Re: file_exists() bypassing , critical problem ? VeNoMouS (Feb 02)
- Re: file_exists() bypassing , critical problem ? Jorrit Kronjee (Feb 02)