PHP Misconfiguration: Missing open_basedir Entry

Giving PHP programs access the entire file system can permit attackers to read, write or create files that they should not be allowed to access.

When present, the open_basedir configuration option attempts to prevent PHP programs from operating on files outside of the directory trees specified in php.ini. If no directories are specified using the open_basedir option, then programs running under PHP are given full access to arbitrary files on the local file system, which can allow attackers to read, write or create files that they should not be able to access.

Failing to specify a restrictive set of directories with open_basedir can make it easier for attackers to exploit other vulnerabilities.

Although the open_basedir option is an overall boon to security, the implementation suffers from a race condition that can permit attackers to bypass its restrictions in some circumstances [2]. A time-of-check, time-of-use (TOCTOU) race condition exists between the time PHP performs the access permission check and when the file is opened. As with file system race conditions in other languages, this race condition can allow attackers to replace a symlink to a file that passes an access control check with another for which the test would otherwise fail, thereby gaining access to the protected file.

The window of vulnerability for such an attack is the period of time between when the access check is performed and when the file is opened. Even though the calls are performed in close succession, modern operating systems offer no guarantee about the amount of code that will be executed before the process yields the CPU. Attackers have a variety of techniques for expanding the length of the window of opportunity in order to make exploits easier, but even with a small window, an exploit attempt can simply be repeated over and over until it is successful.