News for hackers. Stuff that matters.

A comment on Do not use secrets in environment variables. Parent comment

Re:Do not use secrets in environment variables by mlaux on Monday October 07, 2024 @02:09PM (#41769042)
Typically seen more often as something like:

    http://example.com/viewPost.php?post=../../../whatever
(where the server side code has the bug, not the web server configuration itself)
[ Parent | on HN ]
Re:Do not use secrets in environment variables by hinkley on Monday October 07, 2024 @02:33PM (#41769340)
We got access logs like this all the time. SaaS app with separate domain per customer so we got a lot of probes like this.

Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

[ Parent | on HN ]
Re:Do not use secrets in environment variables by Dylan16807 on Monday October 07, 2024 @02:41PM (#41769436)
That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.
[ Parent | on HN ]
Re:Do not use secrets in environment variables by mschuster91 on Monday October 07, 2024 @02:37PM (#41769400)
> Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.

[ Parent | on HN ]