[Code Review] RIPS Scanner v-0.54 - Local File Include (LFI) 
Autor: Roberto dos Santos Soares (espreto) | Publicado: 2015-03-01T01:06:00-03:00

Hi there,&nbsp;

For those using the RIPS scanner [1] to help the analysis of 
vulnerabilities on PHP code, pay attention not to leave it running on 
your network or available to the internet, where anyone can access it.&nbsp;







In a very brief static code analysis of RIPS we found two "Local File Include" (LFI) vulnerabilities as listed below:



1. LFI at "rips/windows/code.php" - it lacks sanitization of the "file" parameter.

 102 &nbsp; &nbsp;$file = $_GET['file'];
&nbsp;103 &nbsp; &nbsp;$marklines = explode(',', $_GET['lines']);
&nbsp;104 
&nbsp;105 &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp;106 &nbsp; &nbsp;if(!empty($file))
&nbsp;107 &nbsp; &nbsp;{
&nbsp;108 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$lines = file($file);
&nbsp;109 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp;110 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// place line numbers in extra table for more elegant copy/paste without line numbers
&nbsp;111 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;echo '&lt;tr&gt;&lt;td&gt;&lt;table&gt;';
&nbsp;112 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;for($i=1, $max=count($lines); $i&lt;=$max;$i++)
&nbsp;113 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;echo "&lt;tr&gt;&lt;td class=\"linenrcolumn\"&gt;&lt;span class=\"linenr\"&gt;$i&lt;/span&gt;&lt;A id='".($i+2).'\'&gt;&lt;/A&gt;&lt;/td&gt;&lt;/tr&gt;';
 114 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;echo '&lt;/table&gt;&lt;/td&gt;&lt;td id="codeonly"&gt;&lt;table id="codetable" width="100%"&gt;';
&nbsp;115 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp;116 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$in_comment = false;
&nbsp;117 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;for($i=0; $i&lt;$max; $i++)
&nbsp;118 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp;119 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$in_comment = highlightline($lines[$i], $i+1, $marklines, $in_comment);
&nbsp;120 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}
&nbsp;121 &nbsp; &nbsp;}





2. LFI at "rips/windows/function.php" - &nbsp;it lacks sanitization of the "file" parameter.
&nbsp; &nbsp; 
 58 &nbsp; &nbsp;$file = $_GET['file'];
 59 &nbsp; &nbsp;$start = (int)$_GET['start'];
 60 &nbsp; &nbsp;$end = (int)$_GET['end'];
 61 
 62 &nbsp; &nbsp;if(!empty($file))
 63 &nbsp; &nbsp;{
 64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;$lines = file($file);
 65 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
 66 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if( isset($lines[$start]) &amp;&amp; isset($lines[$end]) )
 67 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{
 68 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;for($i=$start; $i&lt;=$end; $i++)
 69 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{
 70 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;echo highlightline($lines[$i], $i);
 71 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}
 72 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}




RIPS also found the vulnerabilities in itself:





For example:




Someone else may have found this flaw before, since RIPS hasn't been updated in a while. And could be using it to access sensitive data from unsuspecting users.

A note left on the project website is as follows:

NOTE: RIPS 0.5 development is abandoned. A complete rewrite is in development and used as an academic prototype but it is not publicly available yet. More information about the new version can be found is this paper.


[1]&nbsp;http://rips-scanner.sourceforge.net/


UPDATE:
As mentioned before, someone could have found this glitch and it really happened, as can be seen in the link below:

http://sourceforge.net/p/rips-scanner/bugs/12/

 Thanks Reiners.

Posted previously in http://blog.conviso.com.br/2014/07/rips-scanner-v-054-local-file-include.html by the same author.&nbsp;