Bug 1786572 (CVE-2019-11045) - CVE-2019-11045 php: PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte
Summary: CVE-2019-11045 php: PHP DirectoryIterator class accepts filenames with embedd...
Keywords:
Status: NEW
Alias: CVE-2019-11045
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1789129 1789132 1789133 1786573 1789130 1789131
Blocks: 1786580
TreeView+ depends on / blocked
 
Reported: 2019-12-26 09:55 UTC by Dhananjay Arunesh
Modified: 2020-01-10 17:14 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-12-26 09:55:45 UTC
A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference:
https://bugs.php.net/bug.php?id=78863

Comment 1 Dhananjay Arunesh 2019-12-26 09:56:11 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1786573]

Comment 2 Marco Benatto 2020-01-08 19:50:08 UTC
Upstream patch for this issue:
http://git.php.net/?p=php-src.git;a=commit;h=a5a15965da23c8e97657278fc8dfbf1dfb20c016

Comment 5 Marco Benatto 2020-01-08 20:40:26 UTC
There's an issue with SPL PHP extension on spl_filesystem_object_construct() function. When creating a new DirectoryIterator() object spl_filesystem_object_construct() function is called and use zend to parse its arguments with the wrong parameter type specifier, this bug leads the zend_parse_parameters() to interprete the parameter as a simple string instead of a filesystem path. An attacker may leverage this by crafting a path name containing NULL bytes which will be badly parsed, allowing the attacker eventually by pass any path-based security validation or listing documents from a unexpected directory.

This flaw has a high Confidentiality impact as the actor may eventually seen the filesystem tree from the attacked machine but a high complexity as the attacker may need to have previous knowledge of filesystem organization or trick the user to run the malicious script.


Note You need to log in before you can comment on or make changes to this bug.