4

I've come across Twitto, which basically is a web framework that fits in a tweet. It is so short that I can post the code here :

require __DIR__.'/c.php';
if (!is_callable($c = @$_GET['c'] ?: function() { echo 'Woah!'; }))
  throw new Exception('Error');
$c();

It basically searches for a file named c.php and calls whatever function in that files that is the same name as $_GET['c'].

On the project's website, there is a big red banner at the bottom of the page that reads :

» TWITTO IS NOT SECURE, DON'T USE IT FOR YOUR NEXT WEBSITE «

I am no PHP guru, but to me it looks like if you take all the precautions you normally take with a standard PHP site (sanitizing user input, etc), it should be secure enough ?

What is wrong with this tiny framework ?

EDIT : I understand why this framework is not secure AS-IS, but with the proper bootstrapping and validation checks and everything inside the function you call, it should be just as secure as any other framework ?

Improve this question
0

2 Answers 2

Reset to default
3

This is not secure, since it allows to run any function available on your system.

It's difficult to find a good example of a function which will cause too much harm, since, for example, PHP doesn't have a magic "format my server" parameterless function. Still:

twitto.php?c=phpinfo

for example will display everything about your system to a hacker. Pretty nice, isn't it?

In the same way, you may add some parameterless functions to your app, without expecting them to be called by the end users. For example:

  • DisplayUsersInfo() flushes the information about the users, including the sensitive data,

  • ShowAdminTab(TAB_USERS) shows the users tab in the administration panel by calling DisplayUsersInfo.

The ShowAdminTab($tab) is called only after authentication and other means which protect the administration panel from unauthorized access. Fine. Then somebody calls twitto.php?c=DisplayUsersInfo. No authentication required.

Improve this answer
1

I'ts because of this:

The "Hello World!" controller is now accessible at /twitto.php?c=hello_world.

Anybody can execute your PHP SERVER SIDE code from any browser! (With a simple HTTP GET)!

EDIT I'm pretty sure this call any standard PHP function, Not just the ones in the C.php file, how can you secure that?

Improve this answer
5
  • The function is called without any parameters... I can't think of anything harmful that could be done with a standard PHP function that takes no parameters
    – marco-fiset
    Mar 15, 2012 at 20:27
  • @CollinHockey Look at the Code, where is checking if the function called exists in the c.php file? Its just executing whatever is passed in.
    – Morons
    Mar 15, 2012 at 20:28
  • @Morons: It is executing whatever is passed id but without any parameters. Give me a standard PHP function that can break something which does not require any argument.
    – marco-fiset
    Mar 15, 2012 at 20:32
  • 3
    What about this? php.net/manual/en/function.apache-child-terminate.php
    – Morons
    Mar 15, 2012 at 20:44
  • @Morons I didn't even think of that before. I wasn't thinking about built-ins, but only about the explicitly included files.
    – Collin
    Mar 15, 2012 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.