91–100 of 109 posts
PHP, and its multiple plugins/add-ons written by drooling incompetents, strikes again. When will people learn to just stay away from that cluster-fuck of a language/community?
The advisory says exploitation is not limited to just systems running the original Sendmail MTA, but Postfix' "sendmail" wrapper apparently ignores the "-X" parameter... so how can a Postfix-based system be exploited?
I believe it's because the exploit isn't actually exploiting sendmail, it's expoiting /bin/sh sh -c . Php's implementation of popen() doesn't invoke commands directly with stdlib's execl() or execle()...it calls stdlib's popen(), which passes it through /bin/sh -c . That's assuming phpmailer doesn't treat a postfix sendmail wrapper differently than sendmail. Edit: As far as I can tell, php doesn't allow any way to sp…
I don't see a whole lot that a non-root user calling Postfix's version of sendmail can do with this ... maybe get a mail server RBL'd.
Earlier quoted context omitted.
Why is it possible to do command execution in a mailer at all??? Any reasonable language would have abstracted this into an SMTP library where such things are impossible instead of relying on sendmail.
Likely because PHP has to run things while the end user is waiting for a page to download. They rely on sendmail so that the mail can be queued, versus hanging while the email is sent. PHPmailer can be configured in the way you're describing, but it then has this issue.
Earlier quoted context omitted.
Likely because PHP has to run things while the end user is waiting for a page to download. They rely on sendmail so that the mail can be queued, versus hanging while the email is sent. PHPmailer can be configured in the way you're describing, but it then has this issue.
Opening a socket to a local MTA and dumping a message to it wouldn't take any longer than shelling out to a local sendmail and writing to its stdin.
Earlier quoted context omitted.
I believe it's because the exploit isn't actually exploiting sendmail, it's expoiting /bin/sh sh -c . Php's implementation of popen() doesn't invoke commands directly with stdlib's execl() or execle()...it calls stdlib's popen(), which passes it through /bin/sh -c . That's assuming phpmailer doesn't treat a postfix sendmail wrapper differently than sendmail. Edit: As far as I can tell, php doesn't allow any way to sp…
It's exploiting -f to abuse -X to allow it to save a file with PHP tags to an externally-accessible location. Without -X or some similar capability, it's not exploitable. Well, it is, but not for the same amount of fun -- all you get to do is abuse whatever other arguments Postfix makes available to you. I don't see a whole lot that a non-root user calling Postfix's version of sendmail can do with this ... maybe get…
Earlier quoted context omitted.
Likely because PHP has to run things while the end user is waiting for a page to download. They rely on sendmail so that the mail can be queued, versus hanging while the email is sent. PHPmailer can be configured in the way you're describing, but it then has this issue.
Opening a socket to a local MTA and dumping a message to it wouldn't take any longer than shelling out to a local sendmail and writing to its stdin.
So, yes, you can, but software like Wordpress includes a default configuration that works for most people without additional work...piping to /usr/bin/sendmail.
https://www.reddit.com/r/netsec/comments/5kot1a/phpmailer_52...
I am curious why you linked to reddit? There is nothing in the discussion (4 comments) that is not in the linked advisory. Looking back through your comment history you seem to do this a lot, even linking to discussion pages on reddit with no comments whatsoever and the same link as found in the HN submission.
Could you please refrain from doing that?
> Ok, but to me it was ok as it was a link to more content: resolution, discussions with the author opened by the author of the discovery: dawid_golunski.
https://www.reddit.com/r/netsec/comments/5kot1a/phpmailer_52...
Earlier quoted context omitted.
As far as I can tell, PHP doesn't have any way to spawn a subprocess without passing it to /bin/sh for evaluation. PHPMailer (not core php) apparently either calls php's popen(), which passes to the shell...or calls php's mail(), which uses popen(). There are other options in php, like proc_open(), but they also call /bin/sh. TLDR: There isn't any way in PHP to avoid "relying on the shell to separate options for you"…
It's possible with pcntl_fork() and pcntl_exec() but that's not compatible with apache's mod_php which is probably still pretty widely used even though it's getting replaced by php-fpm.
Earlier quoted context omitted.
I am curious why you linked to reddit? There is nothing in the discussion (4 comments) that is not in the linked advisory. Looking back through your comment history you seem to do this a lot, even linking to discussion pages on reddit with no comments whatsoever and the same link as found in the HN submission.
Hi Could you please refrain from doing that? > Ok, but to me it was ok as it was a link to more content: resolution, discussions with the author opened by the author of the discovery: dawid_golunski. https://www.reddit.com/r/netsec/comments/5kot1a/phpmailer_52...
The best example is this one:
Https://news.ycombinator.com/item?id=13196875
It's the same exact link with no comments. What's the point?
We're jerks and just strip everything down to a-Z space .- and @ _ anything beyond that f u, extensions and 3rd party library or even core filters come out with these vulnerabilities all the time, at least we will know for sure what characters were passed in from the start though I'm sure most business NEED to support every wacky combination but I'll take the complaint over the hack any day.