fix(list): update php-variables #2668
Conversation
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
|
just a question: should we add something like the following syntax seems valid with PHP: php > echo gettype(${'null'});
PHP Warning: Undefined variable $null in php shell code on line 1
NULL
php >
php > echo gettype(${'_SERVER'});
array
php > echo gettype(${'_SER'.'VER'});
array
php > echo gettype(${'_SER' /**/ . /**/ 'VER'});
array |
|
We have 933180 and 933210. But maybe we need an additional rule? Because the technique can be applied everywhere, not just here, right? |
|
I've just checked on the sandbox, and 932130 PL1 Remote Command Execution: Unix Shell Expression Found but PL1 can be bypassed by sending curl -s -H 'x-format-output: txt-matched-rules' -d $"a=\$+{'\$_SER'+.+'VER'}" 'https://sandbox.coreruleset.org/'Also at PL2 it's blocked by 942260 PL2 Detects basic SQL authentication bypass attempts 2/3 |
|
@lifeforms Can you review this one? Per @theMiddleBlue 's comment, we might want a new rule but that is a different story. |
|
I agree we should have a new rule similar to 932130 that detects I checked but in the shell, the space doesn't work: But in PHP it works. So the right place is not the rule 932130. With a space, it aims at a different attack, namely PHP injection. I'll create an issue for that. |
Signed-off-by: Felipe Zipitria felipe.zipitria@owasp.org
Closes #2651