Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Invision Vulnerabilities, including remote code execution
From: "Steven M. Christey" <coley () mitre org>
Date: Wed, 26 Apr 2006 15:41:24 -0400 (EDT)


 sources/action_public/search.php line 1261
 $this->output = preg_replace(
 "#(value=[\"']{$this->ipsclass->input['lastdate']}[\"'])#i", "\\1
 selected='selected'",
 $this->output );

...
an #e modifier is added and then %00 used which will be parsed as a
null byte and truncate the string thus removing the original )#i
part.

This is a very interesting bug: modifying a regular expression in a
way that accesses the execution functionality.

In general, regexp hacking seems to be a fruitful area for research.
As another example, null characters have been used to bypass
security-relevant regexp checks.

As "input validation" becomes more frequent, it seems likely that
these kinds of vulns will be introduced more often.  Other languages
with rich regexp capabilities might be subject to similar issues.

- Steve


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault