HexBrain

Internet Bug Bounty · Report #155223

Use After Free Vulnerability in array_walk()/array_walk_recursive()

Validstatus
5upvotes
13 Oct 2019disclosed

How it was found

https://bugs.php.net/bug.php?id=70713

I think this bugs is still security issue since this bug can be still triggered remotely in some real world&apps.

Example: https://github.com/zendframework/zend-loader/blob/ceb32b5129525e1f19b01f37dbbcc6398b0a9635/src/ClassMapAutoloader.php#L210-L215

        array_walk($parts, function ($value, $key) use (&$parts) {
            if ($value === '..') {
                unset($parts[$key], $parts[$key-1]);
                $parts = array_values($parts);  <==  ['x', 'y', '..'] will be changed into ['x'] from the memory, it is possible to lead to use-after-free.
            }
        });

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original