Security Issue on Apache/PHP, root and external folders can be accesed - php

Question

I am learning PHP and Apache configurations, i am using XAMPP Version: 5.6.19. I have a page named default.php, this page will load a header, a footer and a content subpage between them, this content subpage will be saved on a folder named "content". So to load the site showing the content subpage i would write:
localhost/misite/default.php?page=subpage
to do so i have coded the default.php the following way:
<!--INCLUDE HEADER-->
<?php include 'includes/header.php';?>
<!--LOAD CONTET-->
<?php
/*if page is not set, redirect to index*/
if(!isset($_GET['page']) || strlen($_GET['page']) == 0)
{
header("Location: index.php");
die();
}
/*if page is set*/
else
{
/*search page on contet directory*/
$page = 'content/'.$_GET['page'].'.php';
/*if page not found on content directory, redirect to index*/
if(!glob($page))
{
header("Location: index.php");
die();
}
/*if page is found, load as subpage*/
else
{
?>
<main class = "<?php echo basename($page, '.php'); ?>">
<?php include $page;?>
</main>
<?php
}
}
?>
<!--INCLUDE FOOTER-->
<?php include 'includes/footer.php';?>
I coded it this way in order to only allow load of php files of content folder and most important to prevent access from there to another folder by doing the ../ trick, so if someone try that the result would be:
default?page=../.php
and that will produce a redirect to index page instead.
The problem emerged when i tried to have the same functionality with SEF URL's. I coded the following on the .htaccess:
RewriteEngine On
RewriteBase /misite/
RewriteRule ^([a-zA-Z0-9-]*)$ default.php?page=$1
So i could be able to write
localhost/misite/subpage
So i was expecting the same result as the parameter $1 would be now the value for the "page" parameter on default.php and expected that everything else would be exaclty the same, so i didn't expect to be able to access another folder. But when i tried the following:
localhost/../
As result i got to the dashboard page (localhost/dashboard/) which is a page located outside of mi site folder, and if i try
localhost/..img/ i can access the img folder and so on. It looks like it is not even executing my default.php conditional validations.
I am worried if this could be a security issue and worried if i could get hacked by this. And i don't know why this happens. In case this is a security issue, how can i fix it?

Answer 1

The security risk is with this line:
$page = 'content/'.$_GET['page'].'.php';
Without checking, you're allowing any input to search your disk with the subsequent call to glob. Relative paths will be evaluated, letting the user reference any PHP file on your server.
If all of your PHP files are within 'content' and not in deeper directories, one solution is
// Check "page" only contains letters, numbers, underscore
if (!preg_match('/^\w+$/', $_GET['page'])) {
header("HTTP/1.0 404 Not Found");
exit();
}
$page = 'content/'.$_GET['page'].'.php';
Then you can be confident the path in $page is only referencing a PHP file in your content directory.