Description
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass EDB-10557 · local · Dec 19, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20061003 Advisory 08/2006: PHP open_basedir Race Condition Vulnerability mailing-list
- OpenPKG-SA-2006.023 vendor-advisory
- 20061003 Advisory 08/2006: PHP open_basedir Race Condition Vulnerability mailing-list
- TLSA-2006-38 vendor-advisory
- 20326 vdb-entry
- 1692 third-party-advisory
- http://www.neosecurityteam.net/index.php?action=advisories&id=26
- 22235 third-party-advisory
- 20061009 PHP open_basedir with symlink() function Race Condition PoC exploit mailing-list
- ADV-2006-3901 vdb-entry
- php-openbasedir-security-bypass(29340) vdb-entry
- MDKSA-2006:185 vendor-advisory
- http://www.hardened-php.net/advisory_082006.132.html
- 1016977 vdb-entry
- 22424 third-party-advisory