Executable Regular Expression Error

Opis

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Case (2) is possible in the PHP preg_replace() function, and possibly in other languages when a user-controlled input is inserted into a string that is later parsed as a regular expression.

Skutki

• Confidentiality, Integrity, Availability

  Execute Unauthorized Code or Commands

Zapobieganie

• Implementation

  The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as \Q and \E in Perl.

Przykłady podatności

• CVE-2006-2059 Executable regexp in PHP by inserting "e" modifier into first argument to preg_replace
• CVE-2005-3420 Executable regexp in PHP by inserting "e" modifier into first argument to preg_replace
• CVE-2006-2878 Complex curly syntax inserted into the replacement argument to PHP preg_replace(), which uses the "/e" modifier
• CVE-2006-2908 Function allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.

Słabość nadrzędna

• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Kiedy powstaje

• Implementation

Dotyczy

PHP, Perl

Uwagi

Under-studied. The existing PHP reports are limited to highly skilled researchers, but there are few examples for other languages. It is suspected that this is under-reported for all languages. Usability factors might make it more prevalent in PHP, but this theory has not been investigated.