DirectoryIterator क्लास एक नल बाइट के बाद चुपचाप छोटा कर देता है

An attacker can exploit CVE-2019-11045 to read arbitrary files on the server if the application uses the DirectoryIterator class to process user-supplied filenames without proper sanitization. This could include sensitive configuration files, source code, or even database credentials. The attack typically involves crafting a filename containing a null byte followed by a path to the desired file. For example, a malicious user could provide a filename like 'image.jpg%00/etc/passwd' to the application. The DirectoryIterator would interpret the filename as 'image.jpg' and then attempt to access '/etc/passwd', potentially exposing the contents of the file. The blast radius depends on the application's permissions and the files it processes; a web application with broad file access could be severely compromised. While not directly comparable to Log4Shell, it shares the characteristic of allowing an attacker to bypass intended access controls through crafted input.

1. आरक्षित2019-04-09
2. प्रकाशित2019-12-23
3. संशोधित2024-09-16
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2019-11045 is to upgrade to a patched version of PHP. Upgrade to PHP 7.4.1 or later to eliminate the vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all filenames processed by the DirectoryIterator class. Specifically, strip or reject filenames containing null bytes. Web application firewalls (WAFs) can be configured to detect and block requests containing suspicious filenames. Implement strict file access controls to limit the impact of a potential breach. After upgrading, confirm the fix by attempting to access a sensitive file using a crafted filename containing a null byte; the access should be denied.