CVE-2015-3411

What it actually does

PHP fails to strip or reject %00 (null byte) sequences in pathnames passed to DOMDocument load, xmlwriter_open_uri, finfo_file, and hash_hmac_file, allowing the null byte to truncate the string at the operating-system level and bypass extension or directory restrictions.

Why it matters to the business

Attackers may read or overwrite arbitrary files on the server, exposing sensitive configuration or data and enabling further compromise of the web application or host.

How an attack unfolds

An attacker supplies a filename containing a null byte (for example filename.xml) to an application that calls one of the four affected PHP functions while performing an extension or path check; the check passes but the operating system treats the name as terminating at the null byte, granting access outside the intended scope.

How to fix it

Upgrade PHP to version 5.4.40, 5.5.24, 5.6.8 or later on all affected Red Hat Enterprise Linux and PHP installations; apply vendor patches and rebuild any custom PHP builds.

How to confirm the fix worked

Verify installed PHP version is at or above the fixed releases; attempt a controlled test request containing a null-byte filename against the affected functions and confirm the operation is rejected or truncated correctly.

Typical attack path

1. Locate a PHP application that accepts user-controlled filenames and passes them to DOMDocument::load, xmlwriter_open_uri, finfo_file, or hash_hmac_file after an extension whitelist check
2. Append a null byte followed by an allowed extension (e.g., \0.xml) to the supplied filename
3. Submit the crafted value via HTTP request, form field, or API parameter
4. Observe successful read or write of an arbitrary file outside the permitted directory or extension set

How to detect it

Search web-server and application logs for HTTP requests or POST bodies containing %00 or literal null bytes followed by common extensions; inspect PHP error or access logs for unexpected file paths being opened by the listed functions.

• %00.xml
• %00.jpg
• %00.png
• filename\0
• DOMDocument::load.*%00
• finfo_file.*%00
• hash_hmac_file.*%00

What your security team should do

• Prioritize patching PHP on all internet-facing systems within the next maintenance window
• Audit application code for direct calls to the four listed functions with untrusted input
• Add server-side filename sanitization that explicitly rejects or strips null bytes before any file operation
• Enable PHP open_basedir and disable dangerous functions where feasible