owasp-modsecurity / owasp-modsecurity/ModSecurity
Issue with @inspectFile CGI environment variable PATH_TRANSLATED
@victorhora is already working on this.
Since Sep 25, 2018.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
ModSecurity for Apache 2 sets CGI environment variable "PATH_TRANSLATED" to the file upload approver script name when using inspectFile. This breaks file upoloads for some popular PHP applications (e.g. Typo3), because this variable is also passed to the PHP process that handles the file upload.
It seems that this variable is usually unset for PHP, so I have commented out the following lines in apache2/apache2_util.c:
/* PHP hack, getting around its silly security checks. */
apr_table_add(r->subprocess_env, "PATH_TRANSLATED", command);
apr_table_add(r->subprocess_env, "REDIRECT_STATUS", "302");
This seems to fix this issue for me, file uploads and the approver script still work as expected with PHP in both CGI and FastCGI mode (tested with PHP 5.2, 5.3, 5.5 and 5.6).
This variable has been added in 2003 to fix an issue with PHP: http://blog.modsecurity.org/2003/07/fun-with-php-cl.html
I'm not sure if it is safe to remove this, my guess is that it has been added to allow inspectFile and exec to run PHP-scripts, because PHP thinks it is running in CGI mode when CGI environment varaibles are present, and then a security check would fail if PATH_TRANSLATED is not set to the PHP script name.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.