owasp-modsecurity / owasp-modsecurity/ModSecurity

Issue with @inspectFile CGI environment variable PATH_TRANSLATED

Open
#868 5 comments 0 reactions 1 assignee View on GitHub

@victorhora is already working on this.

Since Sep 25, 2018.

bug Platform - Apache RIP - Type - Feature
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

ModSecurity for Apache 2 sets CGI environment variable "PATH_TRANSLATED" to the file upload approver script name when using inspectFile. This breaks file upoloads for some popular PHP applications (e.g. Typo3), because this variable is also passed to the PHP process that handles the file upload.

It seems that this variable is usually unset for PHP, so I have commented out the following lines in apache2/apache2_util.c:

/* PHP hack, getting around its silly security checks. */
apr_table_add(r->subprocess_env, "PATH_TRANSLATED", command);
apr_table_add(r->subprocess_env, "REDIRECT_STATUS", "302");

This seems to fix this issue for me, file uploads and the approver script still work as expected with PHP in both CGI and FastCGI mode (tested with PHP 5.2, 5.3, 5.5 and 5.6).

This variable has been added in 2003 to fix an issue with PHP: http://blog.modsecurity.org/2003/07/fun-with-php-cl.html

I'm not sure if it is safe to remove this, my guess is that it has been added to allow inspectFile and exec to run PHP-scripts, because PHP thinks it is running in CGI mode when CGI environment varaibles are present, and then a security check would fail if PATH_TRANSLATED is not set to the PHP script name.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.