From 9d17a6a02f1f5d9b88b9df75cde2872a4328eee5 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Sun, 7 Apr 2019 11:37:37 +0200
Subject: Protect against a now-public open_basedir bypass

---
 config/default.rules | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'config/default.rules')

diff --git a/config/default.rules b/config/default.rules
index 11d91b9..82f8b5d 100644
--- a/config/default.rules
+++ b/config/default.rules
@@ -42,6 +42,13 @@ sp.disable_function.function("mail").param("additional_parameters").value_r("\\-
 # Since it's now burned, me might as well mitigate it publicly
 sp.disable_function.function("putenv").param("setting").value_r("LD_").drop()
 
+# This is also burned:
+# ini_set('open_basedir','..');chdir('..');…;chdir('..');ini_set('open_basedir','/');echo(file_get_contents('/etc/passwd'));
+# Since we have no way of matching on two parameters at the same time, we're
+# blocking calls to open_basedir altogether: nobody is using it via ini_set anyway.
+# Moreover, there are non-public bypasses that are also using this vector ;)
+sp.disable_function.function("ini_set").param("varname").value_r("open_basedir").drop()
+
 ##Prevent various `include`-related vulnerabilities
 sp.disable_function.function("require_once").value_r("\.(inc|phtml|php)$").allow();
 sp.disable_function.function("include_once").value_r("\.(inc|phtml|php)$").allow();
-- 
cgit v1.3