>> Developers’ Land of Web Strait.

Recently, I have read some interesting articles about the “PHP security exploit that can be performed using specially crafted GIF images that embed malicious PHP code”.

The problem discovered is that you can insert PHP codes in a GIF image. And surprisingly, it will still be recognized as a valid image by the PHP-function getimagesize().

Definition of PHP-function getimagesize() in PHP Manual:-
The getimagesize() function will determine the size of any GIF, JPG, PNG, SWF, SWC, PSD, TIFF, BMP, IFF, JP2, JPX, JB2, JPC, XBM, or WBMP image file and return the dimensions along with the file type and a height/width text string to be used inside a normal HTML tag.
If accessing the filename image is impossible, or if it isn’t a valid picture, getimagesize() will return FALSE and generate an error of level E_WARNING.

However, how far for the statement - “If accessing the filename image is impossible, or if it isn’t a valid picture, getimagesize() will return FALSE” is true? No matter what your answer will be, my suggestion is that from now onward, you should never trust on getimagesize() for validating if a given image file is in a valid image format.

The following would be a practical example that I had worked around for proving such GIF exploitation problem faced by the PHP community.

My image file was a 32 x 32 pixels GIF-image: logo.gif. I edited it by a Hex Editor (i.e. a binary files editor).

For my case, I appended some PHP codes at the end of the file (as shown in the Diagram above). Ok, now just save it as a PHP file: logo.php.

After that, you can just browse the logo.php from your browser. You will get the result as shown in the diagram below. The PHP script embedded in the “crafted image-GIF” was executed successfully!

Next, we can write a script that use getimagesize() to verify the logo.php. The written script is shown in the Diagram below. Ok, let’s see what would be the output of the script:-

Surprisingly, the output will be…

Yup! You should now trust your eyes rather than the getimagesize() function. As what you are seeing, getimagesize() says “logo.php is a valid 32 x 32 pixels GIF-image.” Too bad ;(

At this stage, you should be aware of the malicious security problem that would arise from this issue. Just imagine what will happen if you had written a Web System that depends fully on getimagesize() for validating the web users’ uploading images? Obviously, you will pay for it! Because not all of the humankinds are kind enough by just echoing “Hello World”!!!