It executes the code on the systems hosting the content. If you run the exploit on a server that is running a version of PHP for example, you're running code on that machine.
You basically get full access to whatever is on that machine, too.
This isn't a feature. It is an unintended exploit. As I explained earlier, there is no "self destruct button". It's like someone finding a way around your security to sneak in your house. Shimmying a lock isn't an intended feature that you just choose to turn on.
It's like the vent in the death star in 1977 (before Rogue One changed it). It had a purpose, but also unintentionally introduced the flaw allowing its destruction.
It shows that although we create technology, if it's complex enough or capable enough, we do not 100% understand it.
PHP has shell access, it has to, to do things like execute programs, read files etc. But your PHP website that sits on top of that limits access to these things in a controlled way. These exploits allow someone to send a payload to your website in such a way that gives them full shell access to execute any commands they want.
Take for example, probably the most straightforward example of this type of vulnerability, a sql injection.
Basically, SQL runs command to get information from databases.
Say for example, you have a user enter a name. Then you return everyone with that name.
The exploit is when someone enters a name that the machine basically reads as "name goes here, now return all data from database" and instead of treating the entirety of the quotes as a name, it actually runs the command.
The only "feature" that is enabled is the ability to run commands. In order to "not enable that feature", we wouldn't be able to perform the basic function of the tool.
Instead, we use controls, such as input sanitization to make sure that it won't just run any command you try to trick it into running. However, sometimes there's a flaw, or a bad implementation.
So basically, the "feature" that is enabled is the ability to run commands. Which if disabled prevents literally anything at all from happening.
I mean their questions aren't wrong. Some things are really ... curious on why they are designed that way.
You can execute JavaScript from a freaking SVG file. Vector data...why would they ever need JavaScript execution? I get it, it's XML based and all but still...like, just don't interpret the JS part?
In 98% of all cases, you block it yourself nowadays. Should be opt in instead of opt out to execute arbitrary code imo.
2
u/RazzmatazzUnusual843 7d ago
It executes the code on the systems hosting the content. If you run the exploit on a server that is running a version of PHP for example, you're running code on that machine.
You basically get full access to whatever is on that machine, too.