diff options
| author | Stanislav Malyshev <stas@php.net> | 2018-11-18 17:10:43 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2018-11-20 11:18:53 -0800 |
| commit | 336d2086a9189006909ae06c7e95902d7d5ff77e (patch) | |
| tree | a8a2cb3d0f0f50f3cb8c0dbf29ab55ef6b66553e | |
| parent | e7acb29eb0626dfebde7675400283d4acfe1f51a (diff) | |
| download | php-git-336d2086a9189006909ae06c7e95902d7d5ff77e.tar.gz | |
Disable rsh/ssh functionality in imap by default (bug #77153)
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | UPGRADING | 7 | ||||
| -rw-r--r-- | ext/imap/php_imap.c | 17 | ||||
| -rw-r--r-- | ext/imap/php_imap.h | 1 | ||||
| -rw-r--r-- | ext/imap/tests/bug77153.phpt | 24 |
5 files changed, 53 insertions, 0 deletions
@@ -17,6 +17,10 @@ PHP NEWS . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR). (cmb) +- IMAP: + . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via + mailbox parameter). (Stas) + - ODBC: . Fixed bug #77079 (odbc_fetch_object has incorrect type signature). (Jon Allen) @@ -99,6 +99,13 @@ PHP 7.2 UPGRADE NOTES from PHP 7.1 on 64-bit machines. This change was necessary to resolve a modulo bias bug in the implementation. +- IMAP: + Starting with 7.2.13, rsh/ssh logins are disabled by default. Use + imap.enable_insecure_rsh if you want to enable them. Note that the IMAP + library does not filter mailbox names before passing them to rsh/ssh + command, thus passing untrusted data to this function with rsh/ssh enabled + is insecure. + ======================================== 2. New Features ======================================== diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index e1adcf2264..42e7d8611c 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -562,6 +562,15 @@ static const zend_module_dep imap_deps[] = { }; /* }}} */ + +/* {{{ PHP_INI + */ +PHP_INI_BEGIN() +STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals) +PHP_INI_END() +/* }}} */ + + /* {{{ imap_module_entry */ zend_module_entry imap_module_entry = { @@ -832,6 +841,8 @@ PHP_MINIT_FUNCTION(imap) { unsigned long sa_all = SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY; + REGISTER_INI_ENTRIES(); + #ifndef PHP_WIN32 mail_link(&unixdriver); /* link in the unix driver */ mail_link(&mhdriver); /* link in the mh driver */ @@ -1049,6 +1060,12 @@ PHP_MINIT_FUNCTION(imap) GC_TEXTS texts */ + if (!IMAPG(enable_rsh)) { + /* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */ + mail_parameters (NIL, SET_RSHTIMEOUT, 0); + mail_parameters (NIL, SET_SSHTIMEOUT, 0); + } + le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number); return SUCCESS; } diff --git a/ext/imap/php_imap.h b/ext/imap/php_imap.h index 7691d1fdd7..556163ed2d 100644 --- a/ext/imap/php_imap.h +++ b/ext/imap/php_imap.h @@ -231,6 +231,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap) #endif /* php_stream for php_mail_gets() */ php_stream *gets_stream; + zend_bool enable_rsh; ZEND_END_MODULE_GLOBALS(imap) #ifdef ZTS diff --git a/ext/imap/tests/bug77153.phpt b/ext/imap/tests/bug77153.phpt new file mode 100644 index 0000000000..63590aee1d --- /dev/null +++ b/ext/imap/tests/bug77153.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter) +--SKIPIF-- +<?php + if (!extension_loaded("imap")) { + die("skip imap extension not available"); + } +?> +--FILE-- +<?php +$payload = "echo 'BUG'> " . __DIR__ . '/__bug'; +$payloadb64 = base64_encode($payload); +$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}"; +@imap_open('{'.$server.':143/imap}INBOX', '', ''); +// clean +imap_errors(); +var_dump(file_exists(__DIR__ . '/__bug')); +?> +--EXPECT-- +bool(false) +--CLEAN-- +<?php +if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug'); +?>
\ No newline at end of file |