Description
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.3.1 - 'session_save_path() Safe_mode()' Restriction Bypass Exploiot EDB-33625 · dos · Feb 11, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c?r1=293036&r2=294272
- ADV-2010-0479 vdb-entry
- http://www.php.net/releases/5_2_13.php
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c?r1=293036&r2=294272
- http://www.php.net/ChangeLog-5.php
- 38708 third-party-advisory
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c?view=log
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c?view=log
- 1023661 vdb-entry
- 20100211 PHP 5.2.12/5.3.1 session.save_path safe_mode and open_basedir bypass third-party-advisory
- 7008 third-party-advisory