CODEWITHSUNDEEP
securityexecphp
user622378
user622378

Reputation: 2336

exec() security

I am trying to add security of GET query to exec function.

If I remove escapeshellarg() function, it work fine. How to fix this issue?

ajax_command.php

<?php
$command = escapeshellarg($_GET['command']);
exec("/usr/bin/php-cli " . $command);
?>

Assume $_GET['command'] value is run.php -n 3

What security check I can also add?

Upvotes: 0

Views: 471

Answers (3)

phihag
phihag

Reputation: 287825

You want escapeshellcmd (escape a whole command, or in your case, sequence of arguments) instead of escapeshellarg (escape just a single argument).

Notice that although you have taken special precautions, this code allows anyone to execute arbitrary commands on your server anyways, by specifying the whole php script in a -r option. Note that php.ini can not be used to restrict this, since the location of it can be overwritten with -c. In short (and with a very small error margin): This code creates a severe security vulnerability.

Upvotes: 6

aib
aib

Reputation: 46941

It will fail unless there's a file called run.php -n 3. You don't want to escape a single argument, you want to escape a filename and arguments.

This is not the proper way to do this. Have a single PHP script run all your commands for you, everything specified in command line arguments. Escape the arguments and worry about security inside that PHP file.

Or better yet, communicate through a pipe.

Upvotes: 1

Jeff Parker
Jeff Parker

Reputation: 7507

escapeshellarg returns a quoted value, so if it contains multiple arguments, it won't work, instead looking like a single stringesque argument. You should probably look at splitting the command up into several different parameters, then each can be escaped individually.

Upvotes: 1

Related Questions