Comment by tptacek
16 hours ago
What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.
16 hours ago
What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.
I think people are just latching onto the post that hit the front page earlier today about it being non-trivial to exploit, combined with the fact that there seem to be about a billion PoC out there, most of which don't work.
Right, that's what's worrying me. It is not interesting that the most widely circulated public POC/demos don't work. All you should care about is the (currently) non-public POCs that do work, of which there are apparently several.
The most direct exploit requires a compromised supply chain which ranks it about as dangerous as your usual dependency exploits.
Say what you will about OpenAI, Wiz etc but if OpenAI, Wiz, Cloudflare, the PHP Foundation and pretty much every CERT out there together recommend to take down PHP apps and patch immediately then I'm very much inclined to follow that advice.
Due to the insane media coverage there'll of course be a deluge of PoCs, most of which won't work. But constantly refreshing Twitter to see whether there's a working PoC is not a good use of time nor a great security strategy.
I think this is just false? Are we playing some kind of weird game of telephone? Is the term "direct exploit" doing way more work in that sentence than you mean it to?
4 replies →
My PoC (generated) was able to exploit an index.php with a simple echo.
The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.
[1] https://github.com/cookiengineer/actual-php2shell
Did you even read the diff, it synthesized intentionally vulnerable code which trivializes the exploitability
I would assume he didn’t read anything in the repo. It also requires disabling ASLR.
1 reply →
Try finding a modern Linux distro without ASLR enabled defaults.
> ASLR
Read the heap feng shui doc, and headline 4 in the README.
The involved heap feng shui is independent of ASLR.
... and maybe read up on what ASLR actually does and how memory arenas work before trying to be smart?