Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers

PHP bug allows attackers to bypass domain filters, stage DoS attacks against serversPost Views: 43
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra

Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A bug in one of PHP’s functions made it possible to bypass security measures meant to protect web applications against malicious user input, a security researcher has found.
filter_var() is a popular function that enables developers to sanitize and validate strings for different data formats such as email addresses, web domains, and URLs.

However, according to the findings of security researcher Jordy Zomer, the function had an integer wraparound flaw that, when triggered, caused the program to bypass filtering logic. Signed and unsigned integersfilter_var() takes an input string and a numeric argument that determines the string’s length. The function signature defined the length argument as a ‘signed integer’, which splits the variable range between negative and positive values.

However, another length variable declared inside the function body was defined as an unsigned integer, which only accepts positive values. The mismatch between the signed and unsigned declarations could cause erratic behavior when the function was provided with very large strings, and caused the program flow to jump over the branch of instructions that applied filters for the hostname and domain flags (FILTER_VALIDATE_DOMAIN and FILTER_FLAG_HOSTNAME).

“Due to the fact that the filter is no longer valid, any code that relies on it as a security check may be bypassed, resulting in the introduction of bugs into your code,” Zomer told The Daily Swig.

“In the course of researching filter_var in conjunction with these flags, I discovered that it is used in combination with these flags quite frequently.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
The bug could also be used to stage denial-of-service (DoS) attacks against PHP web servers with data slightly larger than 2GB.

“My best advice is that it is really crucial that you always utilize the appropriate escaping mechanisms when putting something in a different context than it was before,” Zomer said.

“Another point to emphasize is that filtering your input is never an effective way of preventing vulnerabilities, because different situations call for different escaping strategies.” Limited impactThe filter bypass flaw is triggered only on very large user input, which imposes severe restrictions on its exploitability.

“This bug is unlikely to have a wide impact, because [of] the basic fact that it only influences one specific subfunction in one specific function (namely, domain name filtering), and it requires over 4GB variable size to be supplied to trigger it,” Stanislav Malyshev, developer at PHP internals, told The Daily Swig.

“Any properly configured PHP application should have memory limits and input controls that do not allow 4GB input data for domain names – for the simple reason there’s no legitimate data that could have 4GB domain names.”
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Challenges of maintaining volunteer projectsAccording to Malyshev, the fix has already been checked into the PHP source on March 28, and will be part of the next scheduled formal PHP release.

Zomer, who was not satisfied with the speed of the PHP security team, went ahead and published his own fix for the bug on his websit[...]

___________________________
@hacking_Attack
@Hacking_Video