PHP Bug when using `shell_exec` on Centos Stream and also 8.

[batata004]

Description

In my server selinux is already set to disabled. Also <?php echo exec('whoami'); ?> returns apache. In my visudo I already added the line apache ALL=(ALL) NOPASSWD:ALL. So all look fine.

Then I create this test.php file:

<?php echo shell_exec('sudo echo "aa" > /a.txt'); ?>

If I run this using the command line php test.php it all works fine. However if I try to access domain.com/test.php in the browser (I am using all default configurations from Apache/PHP, nothing changed) the file never gets created and no error message it shown anywhere.

I already reported this on SO and after people looking into this, they told me to come here and report this.

PHP Version

latest but I think affects all 8 version

Operating System

Centos stream and 8

[Hudsxn]

I created a docker container matching all the environment details you provided and could not reproduce the issue:

Is it possible that you're running multiple versions of PHP and different configurations are loaded per instance, a good way to check this would be to run phpinfo() under CLI and over http request and compare the versions, executable location and configuration. Maybe shell_exec is disabled in your apache:php ini.

[batata004]

My dear friend @Hudsxn I didnt use containers and I am pretty sure this bug can be reproduceable. I just reproduced it again on 2 completely fresh servers. And it's not a problem with multiple PHP versions, I am only installing one single PHP version. Also shell_exec is working just fine (and enabled) otherwise the command whoami wouldnt work.

Just to make sure, I took the last 15 minutes and I started a fresh VPS with Centos 9 Stream on Digital Ocean and another one on Linode (now it's Akamai). So I did this exact test on 2 fresh servers. Then I executed these commands below, nothing else:

nano /etc/selinux/config -> SELINUX=disabled
visudo -> apache ALL=(ALL) NOPASSWD:ALL

I restarted the server. Then I executed the commands below:

systemctl disable firewalld
systemctl stop firewalld

dnf config-manager --set-enabled crb
dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
dnf install -y https://rpms.remirepo.net/enterprise/remi-release-9.rpm
dnf module reset php
dnf module list php
dnf module install php:remi-8.2
dnf install httpd php
systemctl restart httpd

I created the file "/var/www/html/test.php" with this content:

<?php 

var_dump(file_put_contents("/b.txt","bb"));

echo shell_exec("whoami");

echo shell_exec('sudo echo "aa" > /a.txt 2>&1');

?>

Then chmod the file created above with 777 permission. Now access it in your browser:

http://IP/test.php

You will see "bool(false) apache". This proves that "shell_exec" is working otherwise we wouldnt see "apache" but the 2 files wont be created. Now execute this file in the command line with php /var/www/html/test.php and you will see both files a.txt and b.txt were created.

[Hudsxn]

Hi @batata004, unfortunately, this isn't accessible as IP isn't a valid domain name. Also, containers work in the same way that an Operating system works through the use of Hyper Virtualization. The version I mocked up in the containers used PHP 8.2, CentOS as you mentioned (stream) and this bug wasn't reproducible. The PHP version is exactly the same as the one you've mentioned on the ticket.

I can appreciate this is a stressful situation, could you share the phpinfo() called from both CLI & a browser request (make sure to remove sensitive information). The phpinfo response may be able to help people diagnose your issue. It could be something small, or it could prove your case in that its a bug.

[devnexen]

exec allows to fetch the error code.

[SakiTakamachi]

@Hudsxn

What will happen to the following code?

echo shell_exec("sudo whoami");

[Hudsxn]

@Hudsxn

What will happen to the following code?

echo shell_exec("sudo whoami");

Depending on privilege level it would usually ask for sudo if necessary, then would output root?

[SakiTakamachi]

@Hudsxn
Sorry, I mentioned you by mistake...

@batata004
How about it?

[batata004]

My dear friends,

I will reply here every question you made me. I booted again a fresh VPS on Linode (Akamai) with Centos 9 Stream. I followed exactly the commands I already provided you above to disable selinux, add apache user to visudo and install Apache+PHP. Pretty simple commands. No need to make any change on httpd.conf or php.ini - everything is by default.

After that I made what you asked me.

@SakiTakamachi

When I created a file test.php with the code below and I called it using a browser at http://IP_OF_MY_SERVER/test.php, it showed me root.

echo exec("sudo whoami");

When I used the code below, it showed me apache. Everything as expected.

echo exec("whoami");

When I call the file test.php using command line php /var/www/html/test.php both commands above show root. As expected.

So nothing wrong with exec, it looks to be working just fine and is enabled by default.

@devnexen

As you requested, I replaced shell_exec with exec and no error was shown and no error was saved in the /var/log/httpd/error_log. For example, when I create the test.php file with only this content:

<?php
echo exec('sudo echo "aa" > /a.txt 2>&1');
echo exec('echo "aa" > /a.txt 2>&1');
?>

And I call this file using the browser http://IP_OF_MY_SERVER/test.php I see no error and no message, just empty response. But the file "a.txt" is never created.

@Hudsxn

I created a file test.php with the content below:

<?php phpinfo(); ?>

Then I called this file using a browser http://IP_OF_MY_SERVER/test.php and command line php /var/www/html/test.php. The outputs of each command is in the files browser - test.html.txt (I had to append .txt because github does not allow me to attach html file) and cli - test.txt.

cli - test.txt
browser - test.html.txt

Hope this help you to narrow down this bug. I assure you it's pretty easy to reproduce, using only the commands I gave you above (disabling selinux, configurting visudo and installing apache/php) you can easily reproduce it on a VPS (I tried on Linode and Digital ocean).

[devnexen]

@devnexen

As you requested, I replaced shell_exec with exec and no error was shown and no error was saved in the /var/log/httpd/error_log. For example, when I create the test.php file with only this content:

<?php
echo exec('sudo echo "aa" > /a.txt 2>&1');
echo exec('echo "aa" > /a.txt 2>&1');
?>

And I call this file using the browser http://IP_OF_MY_SERVER/test.php I see no error and no message, just empty response. But the file "a.txt" is never created.

What I really meant is exec takes 2 other optional arguments, 1 is the return code.