Full Report
The PHP info page is used for displaying information about the current installation. Normally, this is considered a low information disclosure finding. A mitigation for Cross Site Scripting (XSS) is using the HTTPOnly flag on cookies. This prevents the cookie from being used in JavaScript directly. Since session information is commonly stored in cookies, this prevents the stealing of the cookie. The PHP Info page outputs a ton of information about the environment. The weird one to me is that the HTTP_COOKIE field can contain HTTPOnly only cookies! Now, an XSS bug can make a request to the PHP info page in order to get the cookies reflected in the request. This allows for the stealing of HTTPOnly cookies, which is a huge deal in the context of web exploitation. In particular, the PHP session cookie PHPSESSID can be stolen. Overall, a context dependent HTTPOnly bypass within PHP by chaining a normal low severity issue.
Analysis Summary
# Vulnerability: HTTPOnly Cookie Disclosure via PHP Info Page
## CVE Details
- **CVE ID:** N/A (General configuration/design flaw)
- **CVSS Score:** Context-dependent; typically elevated from Low to **Medium/High** when chained with XSS.
- **CWE:** CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-693: Protection Mechanism Failure (HTTPOnly Bypass).
## Affected Systems
- **Products:** Web servers running PHP (Apache, Nginx, etc.).
- **Versions:** All versions where `phpinfo()` is accessible.
- **Configurations:** Systems where `phpinfo.php` (or similar scripts) is publicly accessible and the application uses `HTTPOnly` cookies for session management (e.g., `PHPSESSID`).
## Vulnerability Description
This vulnerability is a **security mechanism bypass**. The `HTTPOnly` flag is designed to prevent client-side scripts (JavaScript) from accessing sensitive cookies, mitigating the impact of Cross-Site Scripting (XSS).
However, the `phpinfo()` function outputs the current environment’s HTTP headers, including the `HTTP_COOKIE` field. This field reflects the raw cookie string sent by the browser, regardless of the `HTTPOnly` flag. By utilizing a separate XSS vulnerability, an attacker can make an asynchronous request (e.g., via `fetch` or `XMLHttpRequest`) to the `phpinfo` page and parse the response to extract `HTTPOnly` session cookies.
## Exploitation
- **Status:** PoC concept available (Widely known technique in penetration testing).
- **Complexity:** Low (Requires a secondary XSS vulnerability).
- **Attack Vector:** Network (Web).
## Impact
- **Confidentiality:** **High**. Allows for the theft of session tokens that were otherwise protected.
- **Integrity:** **High**. Stolen cookies allow for full session hijacking and unauthorized actions as the victim.
- **Availability:** Low.
## Remediation
### Patches
- There is no specific "patch" for `phpinfo()`, as the function is performing as intended. The fix is administrative.
### Workarounds
- **Disable/Delete:** Remove any files containing `phpinfo();` from production environments.
- **Disable Function:** Disable the function globally in the `php.ini` file:
`disable_functions = phpinfo`
- **Access Control:** If the page is required for debugging, restrict access via IP whitelisting or basic authentication at the web server level.
## Detection
- **Indicators of Compromise:** Unusual traffic patterns where an XSS payload triggers a background request to a `phpinfo.php` file.
- **Detection methods and tools:**
- Static Analysis (SAST): Search codebases for occurrences of the `phpinfo()` function.
- Web Application Firewalls (WAF): Monitor for requests to common filenames like `info.php`, `phpinfo.php`, or `test.php`.
- Vulnerability Scanners: Most DAST tools will flag exposed PHP info pages as an information disclosure risk.
## References
- OWASP - Cross Site Scripting (XSS): hxxps[://]owasp[.]org/www-community/attacks/xss/
- PHP Documentation - phpinfo: hxxps[://]www[.]php[.]net/manual/en/function.phpinfo.php
- PortSwigger - Exploiting XSS to steal cookies: hxxps[://]portswigger[.]net/web-security/cross-site-scripting/exploiting/lab-stealing-cookies