Forum Discussion

Tom_Spector_50's avatar
Tom_Spector_50
Historic F5 Account
May 08, 2012

RE: Recent PHP-CGI query string parameter vulnerability

The recently found PHP-CGI query string parameter vulnerability noted in:

 

https://bugs.php.net/bug.php?id=61910v

 

Was announced on May 2nd and as of yet, does not have a solution - http://eindbazen.net/2012/05/php-cg...2012-1823/

 

If you have the F5 Application Security Manager or indeed any F5 product you have the tools to defend yourself without relying on any outside sources by utilizing ASM’s custom attack signatures or TMOS’s iRules.

A signature such as:

 

uricontent:"php?-"; nocase;

 

Would flag any instances of using a ‘-‘ at the start of a PHP query string.

 

This signature can further be refined to target only the instances where the ‘-‘ is used without a ‘=’ in the query or only with relation to the specific switches (e.g. –s,-d and –c) as well as account for spaces between ‘?’ and ‘–‘ e.g. php?+-c

 

Alternatively, you can create an iRule that searches for the same string in a URL.

 

Threats come at you fast – have the tools to defend yourself.

Thanks,

 

Tom.

 

 

app sec
BIG-IP Access Policy Manager (APM)
security
  • kman_52500's avatar
    kman_52500
    Icon for Nimbostratus rankNimbostratus
    May 22, 2012
    If you are using php and CGI on URLs that don't end in .php this will not work.

     

     

    i.e.

     

    ScriptAlias /path /path/to/file.php

     

     

    would still be vulnerable to

     

     

    /path?-s
  • kman_52500's avatar
    kman_52500
    Icon for Nimbostratus rankNimbostratus
    May 22, 2012
    The following appears to do the trick:

     

     

    valuecontent: "-"; depth: 1;
  • jwham20's avatar
    jwham20
    Icon for Nimbostratus rankNimbostratus
    May 23, 2012
    also check out:

     

     

    https://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1090522/Vulnerability-Patching-via-iRules-VU520827-for-PHP.aspx

     

     

     

    Irule response.

     

     

    -josh