Uncaught PHP warning: system() has been disabled for security reasons

[fabacab]

A security misconfiguration can lead to information disclosure due to a failure in the crontab manager to catch PHP errors when the system() function is disabled.

• Buoy version: 0.3.2
• Platform: All
• Browser: All
• URL: http://example.com/wp-admin/*
• Is it reproducible: Yes

Steps to Produce/Reproduce

1. Configure PHP to disallow the system() function (such as by enabling PHP's safe mode or by listing it in the disable_functions PHP configuration setting)
2. Further configure PHP to emit errors to the browser with the display_errors configuration setting.
3. Install or activate Buoy if it is not already installed or activated.
4. Log in with any user to access the WordPress Dashboard.

Expected Results

Buoy gracefully recovers from running in an environment where system() is not permitted.

Actual Results

Users receive a visual warning:

Warning: system() has been disabled for security reasons in /home/[REDACTED]/public_html/wp-content/plugins/buoy/includes/crontab-manager.php on line 70

Warning: system() has been disabled for security reasons in /home/[REDACTED]/public_html/wp-content/plugins/buoy/includes/crontab-manager.php on line 140

Workarounds

None.

Other Information

This has a moderate security impact: if step 2 in the reproduction procedure is enabled on a production deployment, it is considered a security misconfiguration vulnerability leading to an information disclosure exploit.

To mitigate this risk, web server operators are reminded to set the display_errors PHP configuration setting to 0 (meaning "off").