i’ve done some more research and this vulnerability has a history going back to 2002 (
http://www.securiteam.com/unixfocus/5OP0C0A8AC.html ). supposedly other open source projects such as drupal and joomla (those were the two mentioned in documentation i received from this hosting company) have been fixed although there are plugins that are still vulnerable.
this is the error i received going into the manager:
Warning: fopen(/data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/assets/templates/manager/login.html) [function.fopen]: failed to open stream: No such file or directory in /data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/manager/includes/accesscontrol.inc.php on line 130
Warning: filesize() [function.filesize]: stat failed for /data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/assets/templates/manager/login.html in /data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/manager/includes/accesscontrol.inc.php on line 131
Warning: fread(): supplied argument is not a valid stream resource in /data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/manager/includes/accesscontrol.inc.php on line 131
Warning: fclose(): supplied argument is not a valid stream resource in /data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/manager/includes/accesscontrol.inc.php on line 132
this was the error on the site:
« MODx Parse Error »MODx encountered the following error while attempting to parse the requested resource:
« PHP Parse Error »
PHP error debug
Error: file_get_contents(/data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/assets/snippets/ajaxSearch/templates/results.tpl.html) [function.file-get-contents]: failed to open stream: No such file or directory
Error type/ Nr.: Warning - 2
File: /data/16/1/32/5/1521494/user/1637500/htdocs/missioninsight/assets/snippets/ajaxSearch/classes/chunkie.class.inc.php
Line: 73
Line 73 source: $fcontents = file_get_contents($filename);
Parser timing
MySQL: 0.0184 s (0 Requests)
PHP: 0.2119 s
Total: 0.2303 s
this is the explanation from the company to fix the problem:
For security reasons (to prevent “PHP include” hacker attacks), [company removed] sets the allow_url_fopen and allow_url_include PHP directives to off. If you see errors similar to the following on your website, then your website (or software you have installed on your website) uses insecure PHP calls.
Common Errors
Warning: fopen() [function.fopen]: URL file-access is disabled in the server configuration in /……../ on line (..)
Warning: file_get_contents() [function.file-get-contents]: URL file-access is disabled in the server configuration in in /……../ on line (..)
Warning: include() [function.include]: URL file-access is disabled in the server configuration in /……../ on line (..)
Warning: getimagesize() [function.getimagesize]: URL file-access is disabled in the server configuration in in /……../ on line (..)
Warning: readfile() [function.readfile]: URL file-access is disabled in the server configuration in in /……../ on line (..)
Solution
WordPress / Joomla / Drupal Software: These applications do not use functions that require allow_url_fopen or allow_url_include to be turned on. However, certain third party plugins may require changes. If you see any of the errors above, try to isolate which plugin is causing the issue and replace it with an alternative plugin. You should also consider reporting the issue to the plugin developer so that they may fix it in an upcoming release. Alternatively, you can check out some of the examples below and attempt to fix the errors yourself.
Note: Do not attempt to fix issues yourself if you do not have prior software development experience. If the below does not make sense, you should consult with your web professional.
The errors above manifest themselves when your website is attempting to retrieve outside web URLs. The solution is to use the PHP Curl library to do so instead, which is more secure. How you use PHP ‘s Curl library to circumvent this issue depends on which warning you’ve received.
Example 1: Warning: fopen() [function.fopen]:
$file = “
http://news.google.com/news?ned=us&topic=h&output=rss”;
$xml_parser = xml_parser_create();
xml_set_element_handler($xml_parser, "startElement", "endElement");
xml_set_character_data_handler($xml_parser, "characterData");
if (!($fp = fopen($file, "r"))) {
die("could not open XML input");
}
while ($data = fread($fp, 4096)) {
if (!xml_parse($xml_parser, $data, feof($fp))) {
die(sprintf("XML error: %s at line %d",
xml_error_string(xml_get_error_code($xml_parser)),
xml_get_current_line_number($xml_parser)));
}
}
In the above example, an attempt to open a Google RSS feed is being made. The fopen() call will fail because $file is an outside web site, and the rest of the code will not be executed. To properly load the RSS feed and parse, this snipit of code would need to be rewritten as follows:
$xml_parser = xml_parser_create();
xml_set_element_handler($xml_parser, "startElement", "endElement");
xml_set_character_data_handler($xml_parser, "characterData");
$file = “
http://news.google.com/news?ned=us&topic=h&output=rss”;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$xmldata = curl_exec($ch);
curl_close($ch);
$xmldata = split("\n",$xmldata);
foreach ($xmldata as $data) {
if (!xml_parse($xml_parser, $data)) {
die(sprintf("XML error: %s at line %d",
xml_error_string(xml_get_error_code($xml_parser)),
xml_get_current_line_number($xml_parser)));
}
}
Example 2: Warning: file_get_contents() [function.file-get-contents]:
<?php
$contents = file_get_contents(’
http://www.cnn.com/’);
echo $contents;
?>
In the above example, the file_get_contents function is used to retrieve the content of the CNN website. You can accomplish the same thing safely using CURL as follows:
<?php
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, ’
http://www.cnn.com’);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
// display file
echo $contents;
?>
Example 3: Warning: include() [function.include]:
Including files from web hosts is not allowed.
<? php include(“
http://www.example.com/new.php”); ?>
If the file that you are trying to include is local, use relative paths instead , not the web URL. Otherwise, use the following:
<?php
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, ’
http://www.example.com/mew.php’);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
// display file
echo $file_contents;
?>
Example 4: Warning: getimagesize() [function.getimagesize]:
getimagesize() allows you to get the height, width and size of an image file. To use getimagesize() safely, CURL can be used to get the remote file, the data can be saved to a local temporary image file and getimagesize() can be used on the local version.
<php
$filename = “
http://www.example.com/example.jpg”;
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, $filename);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
$new_image = ImageCreateFromString($contents);
imagejpeg($new_image, "temp.jpg",100);
$size = getimagesize("temp.jpg");
// width and height
$width = $size[0];
$height = $size[1];
Example 5: Warning: readfile() [function.readfile]:
<?php
$contents = readfile(’
http://www.example.com/some.txt’);
echo $contents;
?>
In the above example, the readfile function is used to retrieve the content of a remote text file. You can accomplish the same thing safely using CURL as follows:
<?php
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, ’
http://www.example.com/some.txt’);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
// display file
echo $contents;
?>
The above examples are not guaranteed to run without changes, they are strictly guidance to illustrate how to safely retrieve off-site content.
Do i need to re-post this to get more attention?
MODX Staff
