CVE-2004-1392

An attacker who can upload or inject PHP code onto a server where open_basedir is configured can bypass that restriction by calling curl_init() with a file:// URL [ref_id=1]. The cURL library fetches the local file and returns its contents via curl_exec(), ignoring the PHP-level open_basedir directive. The attacker only needs the ability to execute arbitrary PHP code (e.g., via a file upload or a web shell) and network access to the target server's PHP interpreter.

The advisory [ref_id=1] identifies the curl_init() function as the entry point. The underlying defect is in the cURL extension's handling of file:// protocol URLs, which bypasses PHP's open_basedir security check. No specific source file or patch is provided in the bundle.

No patch is included in the bundle. The advisory [ref_id=1] reports that PHP 4.0 with cURL functions does not apply the open_basedir check to file:// URLs handled by the cURL extension. The remediation would require PHP's cURL wrapper to validate the resolved file path against the configured open_basedir directories before allowing the cURL operation to proceed, or to disallow file:// URLs entirely when open_basedir is active.

Create a PHP file (e.g., curl.php) containing: <?php $ch = curl_init("file:///etc/parla"); $file=curl_exec($ch); echo $file ?>. Place it in a web-accessible directory on a server where open_basedir is set to a restricted path (e.g., /var/www/html) and the cURL extension is enabled. Access the script via a web browser; the contents of /etc/parla (or any other file outside the open_basedir restriction) will be displayed [ref_id=1].