Is there a putenv() exploit?

Question

I'm using the following code:

$data = json_decode($_GET["payload"]);
$env = $data->env;

putenv("MYENV=".$env);

But this function is being exploited. I have no idea how. The attacker can execute any code on my machine (Windows).

Does anybody have an idea how this is possible or how to fix it?

Answer 1

This is called ShellShock vulnerability. It basically executes any code the attacker wants if { :;}; are included. For example

MYENV="{ :; }"; /bin/eject

will result in ejecting the dvdrom drive on Linux. So in fact anything is possible here.

Source:

• one
• two
• three
• four

Answer 2

Because some enviroment variable are dangerous like LD_PRELOAD on linux. Generally this not depend exclusively by putenv, but by other possible vulnerability in you code (eg if you exec something that use some magic configuration via enviroment this may led to the exploitaition)