Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay remote code execution

secalert.net

Post reply on HN
Print view View original

1–10 of 17 posts

Re: eBay remote code execution

#2

Post by girvo »

Neat attack, I'd not seen this type before.

I wonder if doing "$cast = (string) $input" prior to the rest will avoid it? I do things like that, as well as making sure all methods use type hinting, which would hopefully make this harder?

Re: eBay remote code execution

#4

Post by zippie »

A prime example of how to deal with and educate others a vulnerability.

Presumably the bounty was distributed without incident which is worth noting the recent threads of bounties being forfeited.

Re: eBay remote code execution

#6

Post by ledneb »

I'm pretty sure the error is when they later take the input and eval it, and the author's managed to dodge their filtering rather than execute arbitrary code in the context of an array-to-string cast (which I was lead to believe when reading that post, at least). Otherwise it implies that some permutation of:

$a = '{${phpinfo()}}'; $b = [$a]; $c = "$b";

Will execute phpinfo()... which it won't.

Re: eBay remote code execution

#7

Post by nwh »

ledneb wrote: post #6

I'm pretty sure the error is when they later take the input and eval it, and the author's managed to dodge their filtering rather than execute arbitrary code in the context of an array-to-string cast (which I was lead to believe when reading that post, at least). Otherwise it implies that some permutation of: $a = '{${phpinfo()}}'; $b = [$a]; $c = "$b"; Will execute phpinfo()... which it won't.

I'm not quite sure I understand it either, though this does execute phpinfo.

    $variable = "{${phpinfo()}}";
    echo "$variable is fish";
I feel I've missed the point.

Re: eBay remote code execution

#9

Post by snapcracker »

nwh wrote: post #7
ledneb wrote: post #6

I'm pretty sure the error is when they later take the input and eval it, and the author's managed to dodge their filtering rather than execute arbitrary code in the context of an array-to-string cast (which I was lead to believe when reading that post, at least). Otherwise it implies that some permutation of: $a = '{${phpinfo()}}'; $b = [$a]; $c = "$b"; Will execute phpinfo()... which it won't.

I'm not quite sure I understand it either, though this does execute phpinfo. $variable = "{${phpinfo()}}"; echo "$variable is fish"; I feel I've missed the point.

Haha same here… anyone care to explain?

Re: eBay remote code execution

#10

Post by foofoobar »

nwh wrote: post #7
ledneb wrote: post #6

I'm pretty sure the error is when they later take the input and eval it, and the author's managed to dodge their filtering rather than execute arbitrary code in the context of an array-to-string cast (which I was lead to believe when reading that post, at least). Otherwise it implies that some permutation of: $a = '{${phpinfo()}}'; $b = [$a]; $c = "$b"; Will execute phpinfo()... which it won't.

I'm not quite sure I understand it either, though this does execute phpinfo. $variable = "{${phpinfo()}}"; echo "$variable is fish"; I feel I've missed the point.

This is how it is executed:

    $variable = "{${phpinfo()}}"; //
If you pass a "{${phpinfo()}}" via GET, it is not executed. The execution has to happen later - e.g. by eval() or /e.
Post reply on HN