[VIM] net2ftp: a web based FTP client :) <= Remote File Inclusion (fwd)

[Steven M. Christey]

CVE dispute, but with a little more detail than "there's no issue."

File this under the growing collection of "really bad research or really
obscure PHP bug".

- Steve

---------- Forwarded message ----------
Date: Mon, 9 Oct 2006 15:26:20 -0400 (EDT)
From: Steven M. Christey <coley at mitre.org>
To: securfrog at gmail.com
Cc: bugtraq at securityfocus.com
Subject: Re: net2ftp: a web based FTP client :) <= Remote File Inclusion


securfrog said:

> i guess you should learn some PHP before posting on bugtracks ...
>
>" net2ftp: a web based FTP client :) <= Remote File Inclusion "
>
>===> you should try your PoC before posting , there's no remote file
>include in that code ...

You are probably looking at recent versions, which don't have the
affected code at all.

The statements as quoted by the original researcher *do* appear in
versions of net2ftp before 0.7:

./net2ftp_v0.1/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.2/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.3/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.4/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.6/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.62/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.61/index.php:require_once($application_rootdir . "/includes/browse.inc.php");
./net2ftp_v0.7/index.php:require_once("./includes/browse.inc.php");

Notice how 0.7 doesn't use $application_rootdir.


For these older versions, we need to figure out where
$application_rootdir came from and if it's controlled by the attacker
at all.

In net2ftp_v0.62, settings.inc.php is included by index.php before
$application_rootdir, and settings.inc.php has:

  $application_rootdir = dirname(__FILE__);

So, $application_rootdir should already be defined.

In 0.1, settings.inc.php has:

  $server_rootdir = "/var/www/php/net2ftp";   // <-- The directory in which the net2ftp application files reside
  ...
  $application_extension = "";                // (Do not use this, it is only for development purposes)
  ...
  $application_rootdir = $server_rootdir . $application_extension;


So, $application_rootdir is defined in 0.1, too.


Given the large number of reports like this, it's not clear whether a
bunch of researchers are making erroneous grep-and-gripe claims
without checking their work, or if there's some obscure PHP scoping
bug that somehow allows variables to be overwritten in weird ways.  I
haven't completely ruled out the latter but don't have any hard proof,
either.

- Steve