Cross Virtual Host Cookie Theft

Friday, December 15. 2006

Within a shared hosting environment it is ~~sometimes~~ quite often possible to bind yourself to some high TCP port and accept incoming connections. Sometimes this is possible because you also get a shell account on the box and sometimes because dangerous PHP functions like stream_socket_server() are not disabled in the configuration. Unfortunately the ability to bind yourself to a port and receive connections is a threat to webapplications installed on different virtual hosts on the same IP, even if other security measures in place, like tight filesystem permissions or executing PHP script with the permission of the owner.

Consider the following PHP script, that will accept incoming connections on port 7778 and print out the connecting user's IP and the content he sends until an empty line.

<?php
  $socket = stream_socket_server("tcp://0.0.0.0:7778", 
                                   $errno, $errstr);
  if (!$socket) {
    echo "$errstr ($errno)<br />\n";
  } else {
    while ($conn = stream_socket_accept($socket)) {
      echo "<h3>".stream_socket_get_name($conn, true)
               ."</h3><br />\n";
      do {
        $line = fgets($conn);
        echo $line . "<br />\n";
        ob_flush(); flush();
      } while (!feof($conn) && strlen(trim($line))>0);
      fclose($conn);
    }
    fclose($socket);
  }?>

Now guess what happens when you connect with your browser to http://my.bookshop.shop:7778/ which happens to share the same IP with your script. The browser will connect to the port under your control and send it's HTTP headers to your script. Unfortunately this HTTP headers will also contain the cookie stored for http://my.bookshop.shop/ because browsers do not save the port number of the HTTP server that orginally set the cookie. This enables anyone on the same IP with the ability to accept connections to steal cookies from other people's webapplications.

A trivial but annoying trick. And considering how many people are vulnerable to URL Include vulnerabilities you can be pretty sure that the majority of PHP5 hosting servers will allow stream_socket_server().

Posted by Stefan Esser in Security, PHP at 01:59

Comments (40)

Link to this post

Comments

Display comments as (Linear | Threaded)

#1 Roxis ()

so, where i can get the _full_ list of dangerous PHP functions ? )

posted on Thursday, December 14. 2006

#2 Cristian Rodriguez ()

hrmmm.. the danger of this function wasn't in my books

thanks Stefan.

posted on Thursday, December 14. 2006

#3 Stefan Esser wrote (Link) ()

A _full_ list will be part of the Suhosin documentation in the future. I am currently 125% loaded with work. Somewhen in January I will release more documentation.

posted on Thursday, December 14. 2006

#4 Ilia Alshanetsky wrote (Link) ()

How is this different from using a small binary to bind to a non-priveleged port? It would be trivial to write a small daemon to bind to arbitrary ports and write input into a text file of choice.

posted on Thursday, December 14. 2006

#5 Stefan Esser wrote (Link) ()

The difference is that dangerous functions like stream_socket_server() are often NOT disabled, because PHP comes with about a million dangerous functions.

But the effect would be the same with a binary. That's why I said sometimes you can do this because you have shell access. (And the ability to execute a binary of your choice is shell access.)

posted on Thursday, December 14. 2006

#6 Ilia Alshanetsky wrote (Link) ()

PHP does not have even 10000 functions, so I fail to see where did you find one million of them

. Shell access it not necessary, you can supply a binary via FTP and have it be loaded via a cronjob (something many ISPs provide). Another way is to setup the binary as a procmail handler and have it be started that way.

As far as binding to sockets most programming languages provide such functionality stock, I fail to see what's so special about the fact that PHP offers it as well.

If anything I'd be complaining to browser makers who fail to include port in the cookie hash and happily disclose sensitive data to other parties.