I’ve spent a lot of time over the past few months writing an enterprise application in PHP.\u00a0 Despite what some people may say, I believe that PHP is as secure or insecure as the developer who is writing the code.\u00a0 Anyway, I’m at the point in my development lifecycle where I decided that it was ready to run an application vulnerability scanner against it.\u00a0 What I found was interesting and I think it’s worth sharing with you all.<\/p>\n
Let me preface this by saying that I’m the guy who gives the training to our developers on the OWASP Top 10, writing secure code, etc.\u00a0 I’d like to think that I have a pretty good handle on programming best practices, input validation, and HTML encoding.\u00a0 I built all kinds of validation into this application and thought that the vulnerability scan would come up empty.\u00a0 For the most part I was right, but there was one vulnerability, one flaw in particular, that found it’s way into every form in my application.\u00a0 In fact, I realized that I’ve made this exact same mistake in almost every PHP form that I’ve ever written.\u00a0 Talk about a humbling experience.<\/p>\n
So here’s what happened.\u00a0 I created a simple page with a form where the results of that form are submitted back to the page itself for processing.\u00a0 Let’s assume it looks something like this:<\/p>\n
<html<\/a>>\r\n <body<\/a>>\r\n <?php\r\n if (isset($_REQUEST['submitted']) && $_REQUEST['submitted'] == '1') {\r\n echo \"Form submitted!\";\r\n }\r\n ?>\r\n <form<\/a> action=\"<?php echo $_SERVER['PHP_SELF']; ?>\">\r\n <input<\/a> type=\"hidden\" name=\"submitted\" value=\"1\" \/>\r\n <input<\/a> type=\"submit\" value=\"Submit!\" \/>\r\n <\/form<\/a>>\r\n <\/body<\/a>>\r\n<\/html<\/a>>\r\n<\/pre>\nIt looks fairly straightforward, right? The problem has to do with that $_SERVER[‘PHP_SELF’] variable. The intent here is that PHP will display the path and name of the current page so that the form knows to submit back to the same page.\u00a0 The problem is that $_SERVER[‘PHP_SELF’] can actually be manipulated by the user.\u00a0 Let’s say as the user I change the URL from https:\/\/www.webadminblog.com\/example.php to https:\/\/www.webadminblog.com\/example.php”><script>alert(‘xss’);<\/script>.\u00a0 This will end the form action part of the code and inject a javascript alert into the page.\u00a0 This is the very definition of cross site scripting.\u00a0 I can’t believe that with as long as I’ve been writing in PHP and as long as I’ve been studying application security, I’ve never realized this.\u00a0 Fortunately, there are a couple of different ways to fix this.\u00a0 First, you could use the HTML entities or HTML special character functions to sanitize the user input like this:<\/p>\n
htmlentities($_SERVER[‘PHP_SELF]);<\/p>\n
htmlspecialchars($_SERVER[‘PHP_SELF]);<\/p>\n
This fix would still allow the user to manipulate the URL, and thus, what is displayed on the page, but it would render the javascript invalid.\u00a0 The second way to fix this is to use the script name variable instead like this:<\/p>\n
$_SERVER[‘SCRIPT_NAME’];<\/p>\n
This fix would just echo the full path and filename of the current file.\u00a0\u00a0\u00a0 Yes, there are other ways to fix this.\u00a0 Yes, my code example above for the XSS exploit doesn’t do anything other than display a javascript alert.\u00a0 I just wanted to draw attention to this issue because if it’s found it’s way into my code, then perhaps it’s found it’s way into yours as well.\u00a0 Happy coding!<\/p>\n","protected":false},"excerpt":{"rendered":"
I’ve spent a lot of time over the past few months writing an enterprise application in PHP.\u00a0 Despite what some people may say, I believe that PHP is as secure or insecure as the developer who is writing the code.\u00a0 Anyway, I’m at the point in my development lifecycle where I decided that it was […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[175,396,395,161,393,394,177,176,10,174],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-web-app-sec","tag-cross","tag-cross-site","tag-form","tag-php","tag-php_self","tag-post","tag-scripting","tag-site","tag-vulnerability","tag-xss"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t