PHP jailing arbitrary code

Question

We have an IRC application for Java, where users are allowed to execute arbitrary PHP and get the result. Here is one example of what this is used for:

btc: <php>$btc = json_decode(file_get_contents('https://btc-e.com/api/2/1/ticker'), true); $ticker = $btc['ticker']; echo "Current BTC Ticker: High: $".$ticker['high']." Low: $".$ticker['low']." Average: $" . $ticker['avg']; 

We also have python customization, but we like PHP because PHP doesn't need new characters in the code anywhere. (Since this is an IRC, we cannot give it new lines unless we execute the downloaded .py web file)

The problem is how to prevent people from trying to use the system, for example, in:

 <php>echo readfile("/etc/passwd"); 

That, obviously, would read the passwd file for everyone to see.
We also have this problem after we tried to block readfile ():

 <php>$rf = readfile; echo $rf("/etc/passwd"); 

How should we protect this system? (The full code is on github, for anyone interested: https://github.com/clone1018/Shocky )

On the sidelines, no real confidential information is disclosed, since all this is in a virtual machine, so this is not a “temporary bomb” or anything else. We still want to block it.

Answer 1

It sounds like clogging a hole in a colander. File system security should be handled by the OS, not the application. And as for /etc/passwd , the OS already provides it.

Here's the first line of my /etc/passwd - yes, I publish it publicly:

 root:x:0:0:root:/root:/bin/bash 

Usually passwords are not actually stored in /etc/passwd . There is information about the user, but the passwords are replaced with x , and the real password is available only to the root user.

However, you should block PHP to some extent. You can change many PHP parameters at runtime with ini_set , including open_basedir . http://www.php.net/manual/en/ini.core.php#ini.open-basedir

Answer 2

If you want to restrict reading of the file, maybe this can help http://www.php.net/manual/en/ini.core.php#ini.open-basedir

If you are using old php version <5.4 you can use php safe mode

http://php.net/manual/en/ini.sect.safe-mode.php

Set the following options for safe mode to restrict php

 safe_mode_exec_dir disable_functions = readfile,system 

and many others

Also, the user will not be able to read any file for which the uid is different, for example. / Etc. / password. Keep in mind that safe mode is amortized / removed from recent php versions