php-security-calendar-2017漏洞分析笔记

Day 1 - Wish List

class Challenge {
  const UPLOAD_DIRECTORY = './solutions/';
  private $file;
  private $whitelist;

  public function __construct($file) {
    $this->file = $file;
    $this->whitelist = range(1, 24);
  }

  public function __destruct() {
    if (in_array($this->file['name'], $this->whitelist)) {
      move_uploaded_file(
        $this->file['tmp_name'],
        self::UPLOAD_DIRECTORY . $this->file['name']
      );
    }
  }
}

$challenge = new Challenge($_FILES['solution']);

漏洞

任意文件上传

分析

在第12行代码中，因为in_array没有设置strict比较，则默认使用宽松比较，具体可参考官方手册,所以虽然设置了白名单，但还是可以进行任意文件上传。

<?php
$whitelist = range(1, 24);
$file_name = '1a.php';
var_dump(in_array($file_name, $whitelist));

//输出结果
bool(true)

Day 2 - Twig

// composer require "twig/twig"
require 'vendor/autoload.php';

class Template {
  private $twig;

  public function __construct() {
    $indexTemplate = '<img ' .
      'src="https://loremflickr.com/320/240">' .
      '<a href="{{link|escape}}">Next slide &raquo;</a>';

    // Default twig setup, simulate loading
    // index.html file from disk
    $loader = new Twig\Loader\ArrayLoader([
      'index.html' => $indexTemplate
    ]);
    $this->twig = new Twig\Environment($loader);
  }

  public function getNexSlideUrl() {
    $nextSlide = $_GET['nextSlide'];
    return filter_var($nextSlide, FILTER_VALIDATE_URL);
  }

  public function render() {
    echo $this->twig->render(
      'index.html',
      ['link' => $this->getNexSlideUrl()]
    );
  }
}

(new Template())->render();

漏洞

xss

分析

第10行代码经过渲染之后可以防止被标签闭合，第22行filter_var($nextSlide, FILTER_VALIDATE_URL)是验证url的函数，只需要构造a://b即可，然后在<a href=''></a>里面可以用javascript:伪协议进行js代码的执行，参考A标签使用javascript:伪协议。因为nextSlide是通过GET请求接收的，那么构造javascript://123%0aalert(1)，这里的//对于filter_var函数来说是协议，但是对于js来说是注释，这样可以巧妙的绕过filter_var函数并且成功执行js代码。因为<a href=''></a>里面跳转的链接是跳转到浏览器，所以对%0a再次进行url编码，所以构造javascript://123%250aalert(1)

Day 3 - Snow Flake

function __autoload($className) {
  include $className;
}

$controllerName = $_GET['c'];
$data = $_GET['d'];

if (class_exists($controllerName)) {
  $controller = new $controllerName($data['t'], $data['v']);
  $controller->render();
} else {
  echo 'There is no page with this name';
}

class HomeController {
  private $template;
  private $variables;

  public function __construct($template, $variables) {
    $this->template = $template;
    $this->variables = $variables;
  }

  public function render() {
    if ($this->variables['new']) {
      echo 'controller rendering new response';
    } else {
      echo 'controller rendering old response';
    }
  }
}