Vuln php curl exec

From Atomicorp Wiki
Revision as of 18:57, 10 February 2012 by Mshinn (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

[edit] PHP function curl_exec() allows an attacker to execute shell commands through php

cURL is a flexible library for performing transfers over a wide range of protocols. This protocol allows file transfers from inside the application. This may expose your system to malicious software being downloaded on the system.


[edit] Next Steps

If this risk is unacceptable for your system, then you will want to disable this capability in PHP.

Step 1: Log into the ASL GUI, click on Configuration and select the ASL configuration menu option. This will open the ASL configuration screen.

Step 2: Scroll down to PHP_CHECKS and make sure this is set to "yes". By default ASL will only warn about PHP vulnerabilities. If you set this to yes, it will also fix these vulnerabilities. If this is set to "no" the next step will not work, so set this to "yes".

Step 3: Scroll down to ALLOW_curl_exec and set this to "no".

Step 4: Click the "update" button.

This will resolve this vulnerability.

Personal tools