1

We have need to send an encrypted string in a query string to a web page. Sometimes because of the encryption, there is an embedded null in the string. Here is an abbreviated example of such a string, showing the characters to the right of the ?:

?code=%FE%00%FE

We have several servers that we are using this with. On some servers, the string is passed into the PHP program in $_GET['code'] just fine, and can be decoded as expected. On other servers, the presence of the %00 in the string causes the $_GET['code'] string to be empty.

Is there some setting or application level aspect that is affecting this?

The query string is working on this stack: Apache 2.4.10 - PHP 5.5.24

The query string is empty on this stack: Apache 2.4.12 - PHP 5.6.9

Improve this question
4
  • What is generating the querystring? If it is your own software can you replace the NULL with a space or some other character?
    – Steve
    Aug 14, 2015 at 0:12
  • Please understand that null encoded attacks against web servers and web applications have been a problem over the past few years so I am not surprised that the nulls are either ignored or equal to nothing or worse. There is nothing wrong with Apache or PHP so there is likely nothing to fix.
    – closetnoc
    Aug 14, 2015 at 0:17
  • As stated in the first sentence, we are sending the encrypted string. In fact we cured the immediate problem exactly as suggested by replacing $00 null with +, which is guaranteed not to be in the string, and doing the reverse in the script receiving the post.
    – Jeffrey Simon
    Aug 15, 2015 at 22:42
  • "replacing $00 null with +" and then URL encoding it (as %2B) I assume. (Otherwise a literal + in the query string will be converted back into a space when read by PHP. Or, you replace a space, not a +, in the received data.)
    – MrWhite
    Aug 15, 2015 at 23:18

1 Answer 1

Reset to default
3

As @closetnoc suggests, the presence of the NULL char in a URL could be seen as the source of an attack (whether the software is vulnerable or not is another matter), so some servers do actively protect against this (however, I'm not aware of this being implemented at the core). RFC3986 - Uniform Resource Identifier (URI): Generic Syntax makes specific reference to this:

Note, however, that the "%00" percent-encoding (NUL) may require special handling and should be rejected if the application is not expecting to receive raw data within a component.

On my server, any URL containing %00 in the query string is actively blocked with mod_security and a 403 Forbidden is served!

However, if you are transmitting binary data in the query string - which is designed for textual data - then it should be base64 encoded first (to convert it to plain text) before being URL (percent) encoded for transmission in the URL.

I've found this PHP bug#53767 report (although considered "Not a bug") from 2011-01-17 for PHP 5.3.4 where the URL parameter appears to be removed entirely from the $_GET array when the value contains %00.

In fact, Rasmus himself replies and says:

Unable to reproduce. Probably running some non-standard PHP code that is doing this.

Improve this answer
1
  • In fact, we decided to change the algorithm entirely for a different reason than the encoding, and thus the whole problem is gone away.
    – Jeffrey Simon
    Aug 15, 2015 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.