CURLOPT_SSLENGINE loads arbitrary shared objects

Description

ext/curl extension passes CURLOPT_SSLENGINE directly to libcurl. When the OpenSSL backend is used, libcurl forwards the value to OpenSSL's dynamic engine loader, ultimately calling dlopen() on the path. This allows executing native code from PHP code subject to open_basedir / `disable_functions (which are not security boundaries anyway).

This libcurl option is documented in https://curl.se/libcurl/c/CURLOPT_SSLENGINE.html. When libcurl is built with OpenSSL, this calls ENGINE_by_id:

static CURLcode ossl_set_engine(struct Curl_easy *data, const char *name)
{
#ifdef USE_OPENSSL_ENGINE
  CURLcode result = CURLE_SSL_ENGINE_NOTFOUND;
  ENGINE *e = ENGINE_by_id(name);
  // (...)
}

https://github.com/curl/curl/blob/6f1dfab6a29242525cdc7b48f5ee49269b9cc316/lib/vtls/openssl.c#L1657-L1693

Internally, if OpenSSL can't find the engine in the default path, it loads the dynamic engine support and uses control commands to load id:

if (strcmp(id, "dynamic")) {
    if ((load_dir = ossl_safe_getenv("OPENSSL_ENGINES")) == NULL)
        load_dir = ossl_get_enginesdir();
    iterator = ENGINE_by_id("dynamic");
    if (!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) || !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) || !ENGINE_ctrl_cmd_string(iterator, "DIR_ADD", load_dir, 0) || !ENGINE_ctrl_cmd_string(iterator, "LIST_ADD", "1", 0) || !ENGINE_ctrl_cmd_string(iterator, "LOAD", NULL, 0))
        goto notfound;
    return iterator;
}

https://github.com/openssl/openssl/blob/fe686e15d84334b284f883118ed92f64b409b3aa/crypto/engine/eng_list.c#L460-L466

Then the dynamic loader uses DSO_load with the absolute path as the second parameter merge:

char *merge = DSO_merge(ctx->dynamic_dso, ctx->DYNAMIC_LIBNAME, s);
if (!merge)
    return 0;
if (DSO_load(ctx->dynamic_dso, merge, NULL, 0)) {

https://github.com/openssl/openssl/blob/fe686e15d84334b284f883118ed92f64b409b3aa/crypto/engine/eng_dyn.c#L379-L382

Internally, DSO_load calls dlfcn_load, which in turn calls dlopen and loads the library:

static int dlfcn_load(DSO *dso)
{
    // (...)
    char *filename = DSO_convert_filename(dso, NULL);
    // (...)
    ptr = dlopen(filename, flags);

https://github.com/openssl/openssl/blob/fe686e15d84334b284f883118ed92f64b409b3aa/crypto/dso/dso_dlfcn.c#L93-L113

I have a patch that prevents any path separator in this option, but that may be too restrictive? I'll open a PR later this week if not.

PHP Version

PHP 8.6.0-dev (cli) (built: May 10 2026 23:58:07) (NTS)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce

Operating System

No response

从 ext/curl 中对 CURLOPT_SSLENGINE 的处理开始，跟踪其值如何传递给 libcurl 和 OpenSSL engine loader。检查该选项记录的行为，并确定针对基于路径加载的安全限制；完成标准是已覆盖此回归问题，并且能够阻止加载任意共享对象，同时不破坏受支持的 engine 标识符。