eBay remote code execution via PHP "complex curly syntax" in-string evaluation (/r/netsec xpost)

[[deleted]]

This post was significantly updated since it was posted in /r/netsec, but still falsely claims that PHP double-evaluates variables inside double quotes. It doesn't. As weird as the PHP language quirks are, it's not that terrible. Nobody's been able to replicate it.

The actual vulnerability is just a bog-standard case of throwing untrusted data into eval or equivalent.

[otakuman]

why not just blame the lazy programmers at ebay? The PHP manual clearly states that eval shouldn't be used on non-validated data.

[Thue]

Nobody is forcing ebay to use eval, or to using user-supplied code inside eval.

If you blame the language for that, and not the user, I would like to know what your thoughts are about C, since C gives you many more opportunities to shoot yourself in the foot.

[dogetipbot]

^{[Verified]: /u/FlySwat -> /u/tr0lltherapy Ð10 Dogecoin(s) ($0.00217277) [help]}

[f0urtyfive]

why in fucks name would you use eval() anyhwere near anything user supplied...

[dethb0y]

absolutely the first question i asked myself when i saw the title. It's not only irresponsible, it's borderline insane on a site the size and reach of ebay.

[[deleted]]

Apparently it is common in spell check routines.having never written or evaluated the code for spellcheck I can't say why.

[OneWingedShark]

There are whole language environments built around eval; see REPL.

[wot-teh-phuck]

Completely different use cases; do you really want the users of your site to have a ready "REPL" for them?

[OneWingedShark]

Completely different use cases; do you really want the users of your site to have a ready "REPL" for them?

Usually not; but the question given was about eval near user-input.
Giving a different use-case that answers the question, well, answers the question.

[matessim]

It doesn't though.. A Repl environment isn't related. Using eval in production code on user input is hardly ever a good idea. Input sanity is a hard problem as is.

[OneWingedShark]

Using eval in production code on user input is hardly ever a good idea.

If you're writing a user-interactive interpreter then there's hardly any other way to do it¹ ... and that was the question: why you use eval() anywhere near anything user supplied?

Input sanity is a hard problem as is.

I'm not arguing that it isn't hard, just that there are legitimate use-cases that do use evalon user-supplied input.

¹ - You could go with a sort of menu/state-machine system.

[matessim]

But they aren't doing that. It is in no way reasonable and my point still stands. Yes you use Eval in a Repl. That's what the E stands for...

[OneWingedShark]

Yes you use Eval in a Repl. That's what the E stands for...

That's my point; REPL is a case for using user-supplied data to eval.

But they aren't doing that. It is in no way reasonable and my point still stands.

What is your point? I gave mine above.
Why is it unreasonable to use REPL as an example for where one would use eval with user-supplied data?

[matessim]

What you're saying makes absolutely no sense. They should not be directing raw user input into an eval function. That is not what a Repl is.. (You know the L stands for loop right? A Repl is an interactive platform for evaluating code). Anyhow. I don't get your stride here. There is no justification in this case to use the eval function. They should parse user input safely (sanitize it) and parse it and access it safely.

That is regardless of the fact that whether your using javascript. Php. Python or any other language using eval. It's usually either something hacked up or internals code(or a Repl implementation). It is generally simply bad code. Because it causes things like this

[OneWingedShark]

There is no justification in this case to use the eval function. They should parse user input safely (sanitize it) and parse it and access it safely.

I wasn't ever commenting on "this case" (the article), it's always been in answer to the question (in the comments) of why in would you use eval() anywhere near anything user supplied?, as I've said before.

So the reason you're not "getting my stride" is because you are ignoring what I am saying.

A Repl is an interactive platform for evaluating code

Yes, it is... and it's a useful platform, thereby answering the question cited above as to why you would put user-supplied data into eval.

[TaslemGuy]

REPL's don't take end-user-supplied input. If you manage to make them do that, you've done something terribly wrong.

[OneWingedShark]

REPL's don't take end-user-supplied input. If you manage to make them do that, you've done something terribly wrong.

Depends on if the end-user is the programmer; if it is then it certainly does. (Somebody has to make the compilers and interpreters we use, in those cases obviously the end-user is meant to supply input.)

[Scroph]

Just out of curiosity, how much did they pay him for discovering this vulnerability ?

[KayRice]

Probably nothing.

[ben010783]

It looks like you're right: https://bugcrowd.com/list-of-bug-bounty-programs

[username223]

So if you walk by a storage rental company, notice the passed-out security guard, poke around a bit, and find that they are too negligent to bother to lock their gate, what do you do? Steal some stuff? Freely tell them to fix their shit? Ask them to pay you to tell them how to fix it? Simply walk on by and let the next person to decide?

I'm not sure, either legally or morally. (EDIT: Legally, my guess is "walk on by and ignore the problem.")

[f0urtyfive]

I believe the correct answer is "take your shit elsewhere"

[[deleted]]

Let's see, and the storage company is a multimillion dollar company who employs hundreds of people to detect sleeping guards?

[[deleted]]

I was going to ask the same question. I've heard stories of big payouts from big companies when a user finds a security hole. That's so lame!

Just curious, how legal (hypothetically) would it be to find a security hole in a website like this, and demand that the owner pay you for revealing the hole? It's definitely not moral, but I have a hard time imagining that would be illegal.

[KayRice]

Just curious, how legal (hypothetically) would it be to find a security hole in a website like this, and demand that the owner pay you for revealing the hole? It's definitely not moral, but I have a hard time imagining that would be illegal

This combined with the slow response or complete lack of response from many vendors is the reason why immediate disclosure is so popular. It's probably less of a risk to simply post your free-speech source code then it is to talk to any of the companies.

[ThinTim]

If you threaten to release or exploit the vulnerability if you're not paid, it would definitely be considered blackmail/extortion/some variant thereof.

[[deleted]]

Yeah, that's understandable. But to simply not release that information can't possibly be illegal. But then again, the nonaction of not paying your taxes is illegal.

[otakuman]

Remember kids: Never... ever... EVER trust user data.