php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #73708 php .user.ini conf file design issue resulting in bypass
Submitted: 2016-12-10 11:50 UTC Modified: 2021-03-16 12:26 UTC
From: tr3jer at gmail dot com Assigned: cmb (profile)
Status: Not a bug Package: *Configuration Issues
PHP Version: Irrelevant OS: all
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: tr3jer at gmail dot com
New email:
PHP Version: OS:

 

 [2016-12-10 11:50 UTC] tr3jer at gmail dot com 
Description:
------------
hello! php security team.I find one .user.ini vulnerabilityinfluences all have .user.ini php versionstest verision = php5.4.user.ini Can be configured open_basedir，so...here i use open_basedir as exampleimage1:http://7xiw31.com1.z0.glb.clouddn.com/QQ20161210-1@2x.pngSo that attackers can not cross this directory and read system fileimage2:http://7xiw31.com1.z0.glb.clouddn.com/QQ20161210-0@2x.pngI think .user.ini just The current directory takes effect，so...again write one .user.ini And the original Do not conflict？

Test script:
---------------
We just have upload file Permissions：image3:http://7xiw31.com1.z0.glb.clouddn.com/QQ20161210-4@2x.pngcreate new directory and write new .user.ini：open_basedir=/image4:http://7xiw31.com1.z0.glb.clouddn.com/QQ20161210-1@2x.pngyep！don't need restart，just wait a few minutes，can bypass .user.ini limit：image5:http://7xiw31.com1.z0.glb.clouddn.com/QQ20161210-3@2x.png

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-12-10 12:01 UTC] tr3jer at gmail dot com
-Operating System: centos +Operating System: all
 [2016-12-10 12:01 UTC] tr3jer at gmail dot com 
os is all
 [2016-12-10 12:26 UTC] requinix@php.net 
Yes, a setting in default/bypass/.user.ini will override a setting in default/.user.ini. That is how it is supposed to work.
If an attacker is able to create files on the server then PHP cannot stop them. If open_basedir is a problem then it should be set at the server level (eg, php.ini).
 [2016-12-11 07:48 UTC] tr3jer at gmail dot com 
but this is .user.ini fault, .user.ini set open_basedir=/home/wwwroot/default, just It should not cross the directory！
 [2021-03-16 12:26 UTC] cmb@php.net
-Status: Open +Status: Not a bug -Assigned To: +Assigned To: cmb
 [2021-03-16 12:26 UTC] cmb@php.net 
> Yes, a setting in default/bypass/.user.ini will override a
> setting in default/.user.ini. That is how it is supposed to work.

That.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Dec 21 13:01:31 2024 UTC