> sources/action_public/search.php line 1261
> $this->output = preg_replace(
> "#(value=[\"']{$this->ipsclass->input['lastdate']}[\"'])#i", "\\1
> selected='selected'",
> $this->output );
>
>...
>an #e modifier is added and then %00 used which will be parsed as a
>null byte and truncate the string thus removing the original )#i
>part.
This is a very interesting bug: modifying a regular expression in a
way that accesses the execution functionality.
In general, regexp hacking seems to be a fruitful area for research.
As another example, null characters have been used to bypass
security-relevant regexp checks.
As "input validation" becomes more frequent, it seems likely that
these kinds of vulns will be introduced more often. Other languages
with rich regexp capabilities might be subject to similar issues.
> sources/action_public/search.php line 1261
> $this->output = preg_replace(
> "#(value=[\"']{$this->ipsclass->input['lastdate']}[\"'])#i", "\\1
> selected='selected'",
> $this->output );
>
>...
>an #e modifier is added and then %00 used which will be parsed as a
>null byte and truncate the string thus removing the original )#i
>part.
This is a very interesting bug: modifying a regular expression in a
way that accesses the execution functionality.
In general, regexp hacking seems to be a fruitful area for research.
As another example, null characters have been used to bypass
security-relevant regexp checks.
As "input validation" becomes more frequent, it seems likely that
these kinds of vulns will be introduced more often. Other languages
with rich regexp capabilities might be subject to similar issues.
- Steve
[ reply ]