Skip to content

Using .php8 in PHP handler leading to RCE #3615

@passtheticket

Description

@passtheticket

Describe the bug
There is no restriction for uploading the file with the .php8 extension. I encountered this situation during penetration testing of a website that uses the elFinder.
In some environments, .php8 can be executed as PHP. Especially, when the PHP is updated from a lower version to 8.x, the .php8 can be added to the .htaccess file for PHP handling like:

For PHP 8.0:
AddHandler application/x-httpd-ea-php80 .php .php8 .phtml
For PHP 8.1:
AddHandler application/x-httpd-ea-php81 .php .php8 .phtml

In another case, .php8 can be executed as PHP according to following the Apache configuration.

<FilesMatch ".+\.ph(p[7-8]?|tml)$">
    SetHandler application/x-httpd-php
</FilesMatch>

To Reproduce
Steps to reproduce the behavior:

  1. Select arbitrary png file to upload.
  2. Capture request with Burp and set content as test<?php phpinfo();?>
  3. Set filename like test.php8
  4. After forwarding the request, the file is successfully uploaded under the files directory

Expected behavior
I think that the php8 can be added to the staticMineMap array in the elFinderVolumeDriver class.

Screenshots
1
2

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions