"The PHP session code explicitly checks for symlinks [...] It does this by opening the file, then doing fstat() on the open file descriptor"
seclists.org/bugtraq/2014/Mar/23
seclists.orgPosted Aug 10, 2014, 10:39 PM UTC
636
seclists.orgI pity the fool who solely relies on the existence of a php session to verify a valid user.
3
Tumbleweed...let me take a stab at it. By the time it opens the file it has already followed the symlink to the target file?
Yes, fstat works on a file descriptor, and it's impossible to open a file descriptor to a symlink.
Either you follow the symlink and open the target (which PHP does), or you declare that you don't want to follow symlinks (O_NOFOLLOW), in which case an open() on a symlink fails.
Edit: Apparently nowadays there's a flag for that.
Actually,
O_PATH | O_NOFOLLOWlets one open a file descriptor to a symlink.Kids these days with their fancy flags.
More like kids these days with their non-portable system calls
[deleted]