PHP Function CRLF Injection Vulnerability
BID:5681
Info
PHP Function CRLF Injection Vulnerability
| Bugtraq ID: | 5681 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0986 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 09 2002 12:00AM |
| Updated: | Jul 11 2009 05:06PM |
| Credit: | Discovery of this issue is credited to Ulf Harnhammar <[email protected]>. |
| Vulnerable: |
PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 PHP PHP 3.0.18 PHP PHP 3.0.17 PHP PHP 3.0.15 PHP PHP 3.0.14 PHP PHP 3.0 .16 |
| Not Vulnerable: | |
Discussion
PHP Function CRLF Injection Vulnerability
PHP includes a number of functions, such as fopen() and file(), which are used to reference external resources, such as other PHP files. If the allow_url_fopen() PHP directive is enabled, these functions may be used to access resources that exist on remote hosts by supplying a URL as an argument to the function. When these functions are used to reference a remote resource, PHP constructs a request for the resource using the appropriate protocol.
A vulnerability has been discovered in PHP which may allow an attacker to add arbitrary data to headers constructed by PHP when remote resources are referenced using these functions. In this way, a PHP script which uses the vulnerable function with the allow_url_fopen() directive enabled may be turned into a proxy, since the attacker is able to construct an arbitrary header to be sent with the request. This may be accomplished by building an arbitrary header using CRLF injection.
PHP includes a number of functions, such as fopen() and file(), which are used to reference external resources, such as other PHP files. If the allow_url_fopen() PHP directive is enabled, these functions may be used to access resources that exist on remote hosts by supplying a URL as an argument to the function. When these functions are used to reference a remote resource, PHP constructs a request for the resource using the appropriate protocol.
A vulnerability has been discovered in PHP which may allow an attacker to add arbitrary data to headers constructed by PHP when remote resources are referenced using these functions. In this way, a PHP script which uses the vulnerable function with the allow_url_fopen() directive enabled may be turned into a proxy, since the attacker is able to construct an arbitrary header to be sent with the request. This may be accomplished by building an arbitrary header using CRLF injection.
References
PHP Function CRLF Injection Vulnerability
References:
References: