Skip to content
Permalink
Browse files

Disable rsh/ssh functionality in imap by default (bug #77153)

(cherry picked from commit 05782f0)
(cherry picked from commit 3f165e8)
  • Loading branch information...
smalyshev authored and cmb69 committed Nov 28, 2018
1 parent bf36d81 commit 3a144d3f7f6bad308e2bf112ebf16829eb298f20
Showing with 44 additions and 0 deletions.
  1. +19 −0 ext/imap/php_imap.c
  2. +1 −0 ext/imap/php_imap.h
  3. +24 −0 ext/imap/tests/bug77153.phpt
@@ -561,6 +561,15 @@ static const zend_module_dep imap_deps[] = {
};
/* }}} */


/* {{{ PHP_INI
*/
PHP_INI_BEGIN()
STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals)
PHP_INI_END()
/* }}} */


/* {{{ imap_module_entry
*/
zend_module_entry imap_module_entry = {
@@ -831,6 +840,8 @@ PHP_MINIT_FUNCTION(imap)
{
unsigned long sa_all = SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY;

REGISTER_INI_ENTRIES();

#ifndef PHP_WIN32
mail_link(&unixdriver); /* link in the unix driver */
mail_link(&mhdriver); /* link in the mh driver */
@@ -1048,6 +1059,12 @@ PHP_MINIT_FUNCTION(imap)
GC_TEXTS texts
*/

if (!IMAPG(enable_rsh)) {
/* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */
mail_parameters (NIL, SET_RSHTIMEOUT, 0);
mail_parameters (NIL, SET_SSHTIMEOUT, 0);
}

le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number);
return SUCCESS;
}
@@ -1135,6 +1152,8 @@ PHP_MINFO_FUNCTION(imap)
php_info_print_table_row(2, "Kerberos Support", "enabled");
#endif
php_info_print_table_end();

DISPLAY_INI_ENTRIES();
}
/* }}} */

@@ -229,6 +229,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap)
#endif
/* php_stream for php_mail_gets() */
php_stream *gets_stream;
zend_bool enable_rsh;
ZEND_END_MODULE_GLOBALS(imap)

#ifdef ZTS
@@ -0,0 +1,24 @@
--TEST--
Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
--SKIPIF--
<?php
if (!extension_loaded("imap")) {
die("skip imap extension not available");
}
?>
--FILE--
<?php
$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
$payloadb64 = base64_encode($payload);
$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
@imap_open('{'.$server.':143/imap}INBOX', '', '');
// clean
imap_errors();
var_dump(file_exists(__DIR__ . '/__bug'));
?>
--EXPECT--
bool(false)
--CLEAN--
<?php
if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
?>

0 comments on commit 3a144d3

Please sign in to comment.
You can’t perform that action at this time.