Path Traversal in PHP via Reserved Device Names

Executive Summary

This vulnerability affects Windows systems running PHP. PHP's filesystem functions do not block reserved device names like CON, PRN, or NUL when they appear in file paths. Attackers can exploit this by providing a malicious path that opens a device instead of a file, causing hangs or process exhaustion.

Useful 0 Not Useful 0

Detection Guidance

Check for filenames containing reserved Windows device names (CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9, CONIN$, CONOUT$) in logs or file paths. Use PowerShell: Get-ChildItem -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match '(?i)(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9]|CONIN\$|CONOUT\$)' }

Scan PHP applications for file operations using these reserved names. Check web server access logs for unusual paths containing these terms.

Useful 0 Not Useful 0

Impact Analysis

An attacker could disrupt applications by forcing them to interact with system devices instead of files, leading to hangs, crashes, or resource exhaustion. This may cause denial-of-service conditions or unexpected behavior in PHP-based applications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it primarily impacts system availability and process exhaustion rather than data confidentiality or integrity. However, if exploited to disrupt services handling sensitive data, it could indirectly impact compliance by causing delays or failures in processing personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update PHP to the latest version where this issue is fixed. Validate all user-controlled filenames against a list of reserved device names before processing. Implement strict input validation in PHP applications handling file paths.

Configure PHP to reject paths with reserved names via custom stream wrappers or filesystem checks. Monitor for blocked worker processes or hangs in PHP applications.

Useful 0 Not Useful 0