CVE-2015-3211: Medium severity ubuntu php-fpm vulnerability
It was reported that php-fpm package is vulnerable to symlink attack:
ls -lad /var/log/php-fpm drwxrwx--- 2 apache root 4096 May 28 18:53 /var/log/php-fpm
https://git.centos.org/blob/rpms!php/4b401fd4915cda3a1a336902afad4e5321859c32/SPECS!php.spec#L1409
%attr(770,apache,root) %dir %{localstatedir}/log/php-fpm
After installing php-fpm package, any software running under apache user can create symlink /var/log/php-fpm/error.log pointing to any file. After starting php-fpm service - file pointed by symlink will be appended by php-fpm log output. If a file did not exist before - it will be created. This issue only exist for a short time - after php-fpm package install and before php-fpm process is started for the first time. Exiting working configurations are not affected by this issue.
Steps to reproduce: - make sure you don't have php-fpm leftovers: # rm -rf /var/log/php-fpm - install php-fpm: # dnf install php-fpm - as an 'apache' user create an evil symlink: # su -s /bin/bash - apache $ ln -s /root/.bashrc /var/log/php-fpm/error.log - start php-fpm process: # systemctl start php-fpm - look at the contents of /root/.bashrc file (php-fpm error log output will be appended there) # cat /root/.bashrc
Other sources
php-fpm allows local users to write to or create arbitrary files via a symlink attack.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3211?
CVE-2015-3211 is classified as a medium severity vulnerability due to its impact on unauthorized access to sensitive files.
How do I fix CVE-2015-3211?
To resolve CVE-2015-3211, ensure that the permissions on the /var/log/php-fpm directory are properly configured to restrict access.
Which software is affected by CVE-2015-3211?
CVE-2015-3211 affects the php-fpm package across various versions.
What type of attack does CVE-2015-3211 involve?
CVE-2015-3211 involves a symlink attack, allowing an attacker to potentially access data through improperly protected log files.
Can CVE-2015-3211 be exploited remotely?
Yes, CVE-2015-3211 can potentially be exploited remotely by leveraging weak directory permissions.