News for hackers. Stuff that matters.
Re:Do not use secrets in environment variables by spankalee on Monday October 07, 2024 @02:00PM (#41768918)
In what world does this work?

    $ curl http://your-website.com/public/../../../../proc/12345/environ
If your server is serving up your whole filesystem, you likely have a lot of big problems.
Re:Do not use secrets in environment variables by vundercind on Monday October 07, 2024 @02:22PM (#41769218)
That specific example? If you’ve done an amazing bad job of configuring a web server.

Similar examples that involve passing paths as e.g. query strings? When you’ve written an application that takes a real file path as a parameter and haven’t done any of several things that can prevent that from pointing to files you don’t want it to.

Re:Do not use secrets in environment variables by mlaux on Monday October 07, 2024 @02:09PM (#41769042)
Typically seen more often as something like:

    http://example.com/viewPost.php?post=../../../whatever
(where the server side code has the bug, not the web server configuration itself)
Re:Do not use secrets in environment variables by hinkley on Monday October 07, 2024 @02:33PM (#41769340)
We got access logs like this all the time. SaaS app with separate domain per customer so we got a lot of probes like this.

Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

Re:Do not use secrets in environment variables by Dylan16807 on Monday October 07, 2024 @02:41PM (#41769436)
That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.
Re:Do not use secrets in environment variables by mschuster91 on Monday October 07, 2024 @02:37PM (#41769400)
> Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.

Re:Do not use secrets in environment variables by sureglymop on Monday October 07, 2024 @02:30PM (#41769301)
I recently found exactly this vulnerability in a non trivial php app that is pretty widely deployed.. I think it just slipped through.
Re:Do not use secrets in environment variables by PaulDavisThe1st on Monday October 07, 2024 @02:09PM (#41769043)
and even if your server can reach it, here (Debian 11), all of /proc/PID/environ is marked 0400, root:root owned.
Re:Do not use secrets in environment variables by miohtama on Monday October 07, 2024 @02:18PM (#41769164)
Usually they work in PHP world
Re:Do not use secrets in environment variables by Fidelix on Monday October 07, 2024 @02:21PM (#41769209)
what a nonsense notion... are you living in 1997?
Re:Do not use secrets in environment variables by hinkley on Monday October 07, 2024 @02:35PM (#41769355)
Last time I argued with someone about PHP was about 2014 and his app got hacked that evening. You’re being verrry generous with how long PHP has not sucked.
Re:Do not use secrets in environment variables by SoftTalker on Monday October 07, 2024 @02:25PM (#41769250)
The world where ChatGPT configures your server?
Re:Do not use secrets in environment variables by richwater on Monday October 07, 2024 @02:07PM (#41769015)
You'd be surprised...
Re:Do not use secrets in environment variables by Sohcahtoa82 on Tuesday October 08, 2024 @12:23PM (#41779056)
As an AppSec engineer and penetration tester...

You'd be scared how often this works (Though not in the exact method you described). It might not even be a path traversal vulnerability [0] that lets you read files, it could be a shell injection [1] that allows you to `cat` the file.

[0] https://en.wikipedia.org/wiki/Directory_traversal_attack

[1] https://en.wikipedia.org/wiki/Code_injection#Shell_injection