PHP Safe Mode Bypass Vulnerability

vendor:

PHP

by:

SecurityFocus

7.5

CVSS

HIGH

Bypassing Safe Mode

264

CWE

Product Name: PHP

Affected Version From: 4.3.2000

Affected Version To: 4.3.2000

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2003

PHP Safe Mode Bypass Vulnerability

PHP is prone to an issue that may allow programs to bypass Safe Mode by calling external files in restricted directories using include() and require(). The problem is known to occur when the safe_mode_include_dir PHP directive is not defined. A logic error reportedly exists which could result in PHP failing to run a security check when attempting to access a file via an include() or require() call, potentially bypassing the Safe Mode model. This could allow unauthorized access or policy bypass in environments that use Safe Mode, such as in cases where a web server resource is shared by multiple users.

Mitigation:

Define the safe_mode_include_dir PHP directive to restrict access to external files.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8201/info

PHP is prone to an issue that may allow programs to bypass Safe Mode by calling external files in restricted directories using include() and require().

The problem is known to occur when the safe_mode_include_dir PHP directive is not defined. A logic error reportedly exists which could result in PHP failing to run a security check when attempting to access a file via an include() or require() call, potentially bypassing the Safe Mode model. This could allow unauthorized access or policy bypass in environments that use Safe Mode, such as in cases where a web server resource is shared by multiple users.

This issue is reported to exist in PHP versions 4.3.0 and later. 

<?
echo("trying to read /etc/passwd");
include("/etc/passwd");
?>