{"id":116414,"date":"2024-06-07T12:05:45","date_gmt":"2024-06-07T10:05:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi"},"modified":"2024-06-07T12:05:45","modified_gmt":"2024-06-07T10:05:45","slug":"uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi","title":{"rendered":"Zranitelnost v PHP, kter\u00e1 umo\u017e\u0148uje vykonat k\u00f3d p\u0159i pr\u00e1ci v re\u017eimu CGI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V PHP byla zji\u0161t\u011bna zranitelnost (CVE-2024-4577), kter\u00e1 umo\u017e\u0148uje prov\u00e9st vlastn\u00ed k\u00f3d na serveru nebo zobrazit zdrojov\u00fd k\u00f3d PHP skriptu, pokud je PHP pou\u017e\u00edv\u00e1no v re\u017eimu CGI na platform\u011b Windows (konfigurace s mod_php, php-fpm a FastCGI zranitelnosti nejsou vystaveny). Probl\u00e9m byl odstran\u011bn ve verz\u00edch PHP 8.3.8, 8.2.20 a 8.1.29.<\/p>\n

Zranitelnost je speci\u00e1ln\u00edm p\u0159\u00edpadem v roce 2012 opraven\u00e9ho probl\u00e9mu CVE-2012-1823, pro kter\u00fd se uk\u00e1zalo, \u017ee ochrana je nedostate\u010dn\u00e1 pro zablokov\u00e1n\u00ed \u00fatoku na platform\u011b Windows. Metoda \u00fatoku spo\u010d\u00edv\u00e1 v mo\u017enosti zasunut\u00ed argumentu p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku p\u0159i spu\u0161t\u011bn\u00ed interpretu PHP manipulac\u00ed s parametry po\u017eadavku na PHP skript. <\/p>\n

Ve star\u00e9 zranitelnosti CVE-2012-1823 sta\u010dilo pou\u017e\u00edt volby p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku m\u00edsto parametr\u016f dotazu, nap\u0159\u00edklad \u201ehttp:\/\/localhost\/index.php?-s\u201c pro zobrazen\u00ed zdrojov\u00e9ho k\u00f3du skriptu. Nov\u00e1 zranitelnost vych\u00e1z\u00ed z toho, \u017ee platforma Windows zaji\u0161\u0165uje automatickou konverzi znak\u016f, co\u017e umo\u017e\u0148uje obej\u00edt d\u0159\u00edve p\u0159idanou ochranu a zad\u00e1vat znaky, kter\u00e9 se nach\u00e1zej\u00ed v n\u011bkter\u00fdch k\u00f3dov\u00e1n\u00edch a kter\u00e9 jsou nahrazeny znakem \u201e-\u201c (nap\u0159\u00edklad http:\/\/localhost\/index.php?s). <\/p>\n

Zranitelnost byla potvrzena v konfigurac\u00edch s lokalizacemi pro tradi\u010dn\u00ed \u010d\u00edn\u0161tinu (cp950), zjednodu\u0161enou \u010d\u00edn\u0161tinu (cp936) a japon\u0161tinu (cp932), ale nen\u00ed vylou\u010deno jej\u00ed projeven\u00ed i s jin\u00fdmi lokalizacemi. Probl\u00e9m se projevuje v konfiguraci v\u00fdchoz\u00ed sady XAMPP (Apache + MariaDB + PHP + Perl) a tak\u00e9 v jak\u00fdchkoli konfigurac\u00edch Apache, v nich\u017e je php-cgi nastaven jako zpracovatel CGI skript\u016f pomoc\u00ed nastaven\u00ed
\n'Action cgi-script \"cgi-bin\/php-cgi.exe\"' nebo 'Action application\/x-httpd-php-cgi \"php-cgi\/php-cgi.exe\"', nebo p\u0159i p\u0159\u00edm\u00e9m um\u00edst\u011bn\u00ed interpretru php do \"cgi-bin\" a jak\u00fdchkoli dal\u0161\u00edch adres\u00e1\u0159\u016f, ve kter\u00fdch je povoleno vykon\u00e1vat CGI skripty prost\u0159ednictv\u00edm direktivy ScriptAlias.<\/p>\n

Krom\u011b toho byly v aktualizac\u00edch PHP 8.3.8, 8.2.20 a 8.1.29 odstran\u011bny dal\u0161\u00ed t\u0159i zranitelnosti: <\/p>\n