Sec Bug->Bug #81131 [Asn]: open_basedir bypass through bindtextdomain()

Edit report at https://bugs.php.net/bug.php?id=81131&edit=1 ID: 81131 Updated by: cmb@php.net Reported by: jeffbencteux at gmail dot com Summary: open_basedir bypass through bindtextdomain() Status: Assigned -Type: Security +Type: Bug Package: Gettext related Operating System: Debian 10 PHP Version: 8.0.7 Assigned To: stas Block user comment: N Private report: Y New Comment: open_basedir bypasses are not considered to be security issues; cf. <https://externals.io/message/105606> and <https://externals.io/message/115406>. Previous Comments: ------------------------------------------------------------------------ [2021-07-01 15:29:39] cmb@php.net The fix is trivial: ext/gettext/gettext.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ext/gettext/gettext.c b/ext/gettext/gettext.c index 003787f5c0..cc027d57fd 100644 --- a/ext/gettext/gettext.c +++ b/ext/gettext/gettext.c @@ -278,6 +278,10 @@ PHP_NAMED_FUNCTION(zif_bindtextdomain) RETURN_FALSE; } + if (php_check_open_basedir(dir_name)) { + RETURN_FALSE; + } + retval = bindtextdomain(domain, dir_name); RETURN_STRING(retval); I'm not sure, though, whether not checking open_basedir is by design. Stas, what do you think? ------------------------------------------------------------------------ [2021-06-12 17:24:40] jeffbencteux at gmail dot com Description: ------------ It is possible to test for files and directories existence by using the $category parameter of the bindtextdomain() PHP function, thus bypassing open_basedir restriction. A potential attacker could enumerate files with the help of a dictionary. The root cause seems to be that this function does not enforce checks for open_basedir restrictions. Test script: --------------- <?php /* Assuming: * web root in /var/www/html/ * php.ini with open_basedir = /var/www/html/restricted mkdir /var/www/html/restricted echo "test" > /var/www/html/test.txt The current file is located in /var/www/html/restricted/test.php */ echo bindtextdomain("test", "../test.txt"); ?> Expected result: ---------------- Warning: bindtextdomain(): open_basedir restriction in effect. File(/var/www/html/test.txt) is not within the allowed path(s): (/var/www/html/restricted) in /var/www/html/restricted/test.php on line 14 Actual result: -------------- /var/www/html/test.txt ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81131&edit=1