This incidence is only to communicate that I have found a vulnerability in the HTML Purifier package, specifically in the evalArray($contents) function inside HTMLPurifier_ConfigSchema_InterchangeBuilder class.

Remote exploitation of such vulnerability is unlikely, but it is still advisable to take it into account.

Attached a php document index.txt (rename to index.php) to force the execution of the code and Test.Sample.txt with the injection of code in the eval function using ALLOWED Directive.

Need download the htmlpurifier library and put inside the apache web project as you can see in the image.

For any questions I'm at your disposal.

CommentFileSizeAuthor
index.txt230 bytesiricartb
Test.Sample.txt296 bytesiricartb
index.jpg83.5 KBiricartb

Comments

iricartb created an issue.

ezyang’s picture

ezyang commented

I'm not convinced that this is actually a security problem. buildFromDirectory() is an internal function which is called as part of the build process for HTML Purifier, and shouldn't ever be called when someone has deployed HTML Purifier to purify HTML. Do you have an attack model where this could result in an exploit?

iricartb’s picture

iricartb commented

In the example, the call to the buildFromDirectory() function is forced to process the directives in example topic, this is already done by the library automatically once configured.

The main idea is that a malicious directive file like the one shown in the example Test.Sample.txt could execute code on the server because the eval function does not correctly parse the input value, in this case ALLOWED key value.

However, to exploit it, someone with access should be able to enter plain text files with malformed directives, which is not trivial.

jroca68’s picture

jroca68 commented

It could also happen that a user with access to the server would be restricted to code execution through security policies, but nevertheless with write access to that folder, then he could execute code using the user configured in the apache such as www-data, elevating your privileges, even so, the error can be effective if exists a bad configuration of the server.

ptorrescabeo’s picture

ptorrescabeo commented

that is, local privilege escalation

ptorrescabeo’s picture

ptorrescabeo commented

Fraudulent directives could be executed again once the apache service has been restarted.

jroca68’s picture

jroca68 commented

Tested in HTML Purifier v4.10.0, the eval function is overwhelmed.