5 ms·
New PHP Vulnerability:?-s may expose source code for mod_cgi
- NaturalDoc 14y agowhat? a new php vulnerability? havent heard of one of these for a few hours!!
- soc88 14y agoI don't understand why this is downvoted, considering that the bugfixes don't work.
- EvilTerran 14y agoPerhaps because vacuous, pandering snark adds absolutely no value to the conversation?
- ComputerGuru 14y agoThis vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. <insert immense sigh of relief>. Thank God. That said, some blackhats are going to be really sore that a backdoor that's been wide open for "at least 8 years" is finally being closed.
- thaumaturgy 14y agoIt also does not appear to be a problem on servers running php via libapache2-mod-fcgid.
- ComputerGuru 14y agoIt basically only affects PHP as CGI (one PHP CGI process is started and stopped for each request). Anything using an alternative communication channel or API to process requests between frontend and backend is safe (for now).
- kevindication 14y agoGiven how long this has been a problem, it would be interesting to look back through access logs to find attempts to use this.
- maratd 14y agoAdditionally: The vulnerability can only be exploited if the HTTP server follows a fairly obscure part of the CGI spec. Apache does this, but many other servers do not. From: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
- ecaron 14y agoYou're right, my title was a bit sensational. I softened it a bit by appended mod_cgi. I think it is very telling that the PHP core recognizes that the people using mod_cgi probably can't upgrade so they're offering a .htaccess adjustment - very commendable.
- kijin 14y agoWell, after all, PHP is all about backwards compatibility.
- harshreality 14y agoAnyone using a php CGI app could easily have more serious problems than source code disclosure. Those kinds of apps have often been around over a decade with little or no modifications or auditing, because if someone cared enough about the apps to maintain or audit them it's likely they'd have moved to a more performant backend.
- deleted 14y ago[deleted]
- eevee 14y agoExposing source code is the least of your problems. With creative use of command-line arguments, you can run arbitrary PHP code via any vulnerable URL. It took me a bit to figure out _how_, but it's nothing obscure or difficult. In fact it relies on _other_ bozotic PHP behavior to work!
- Palomides 14y agohttp://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ has some more info, including the fact that they first reported it to the PHP devs in the middle of January.
- nthitz 14y agoWow, it's pretty scary that a vulnerability as simple as this has been around for 8 years!
- fusiongyro 14y agoYeah, but nobody's run PHP in this silly CGI configuration for 10 years.
- reginaldo 14y agoYeah, last time I worked with php was 2002 and we were already on mod_php.
- bleusink 14y agoI wouldn't be so sure: http://wiki.dreamhost.com/Php#PHP_on_DreamHost http://wiki.dreamhost.com/Php#PHP_on_DreamHost
- maratd 14y agoThat's horrible! I would never use a host that relied on CGI for anything. There's a reason they came out with FastCGI.
- devicenull 14y agoFastCGI makes little to no sense on shared web hosting machines. With FastCGI, each user on the machine needs at least one long-running process to handle requests. This is a waste when you consider that large numbers of the sites may be idle 99% of the time. With CGI, you only have PHP processes running when they are actually handling requests, it's really a much better solution for shared hosting.
- kbolino 14y agoWhat is it wasting? If the process is idle, then it is only taking up space in memory. If that space isn't needed, then the cost is nil (it takes the same amount of power to store a 1 as a 0; the real power cost is in moving data in and out of memory, not in storing it). If the space is needed, then the idle process can be swapped out to disk. So again, no practical cost. FastCGI may not be the best solution, but CGI is not an improvement (the overhead of starting a new runtime to handle every request will introduce a lot of latency, which will be especially noticeable on pages that make a lot of asynchronous requests).
- vog 14y agoFrom the article: > [...] we had a bug in our bug system [...] causing this issue to go public before we had time to test solutions to the level we would like. Ouch.
- cheald 14y agoSo we know about this issue because the bug for the disclosure vulnerability was vulnerable to disclosure because of a bug.
- richbradshaw 14y ago8 years!!!! I wonder how many people knew about this already... On the other hand, this does make me feel better about my own code!
- randomdrake 14y ago1) It's not new. 2) Running PHP as regular CGI (not FCGI) is a very dated practice so the amount of implementations that are vulnerable is probably limited.
- gouranga 14y agoThat's hilariously shitty. Although to be honest I doubt it's going to affect anyone as I reckon 99%+ are on mod_php.
- TazeTSchnitzel 14y agoHuh. I'd used that method of passing in parameters, mistakenly thinking it was the correct way to get a query string. Then I asked on SO and found out I was doing things horribly, horribly wrong.
- yahelc 14y agoHow would that have worked?
- TazeTSchnitzel 14y agohttp://example.com/cgi/mything?stuff Results in apache calling: /home/ajf/cgi/mything stuff
- jsnrkd 14y agoDoes anyone have an example site to see this in action?
- micahshell 14y agoHere's my old schools site, theirs no sensitive information. www.ptecwebdev.com?-s
- driverdan 14y agoNo sensitive information? http://www.ptecwebdev.com/configuration.php?-s http://www.ptecwebdev.com/configuration.php?-s
- yahelc 14y agoI'd thought you could find some with this Google search, but I haven't gotten any to work. https://www.google.com/search?q=inurl:%22cgi-bin%22+inurl:php&hl=en&safe=off&prmd=imvns&ei=9fSiT9nlBomI6AG50N35CA&start=10&sa=N&biw=1015&bih=557 https://www.google.com/search?q=inurl:%22cgi-bin%22+inurl:ph...
- jgeralnik 14y agoUsing that search and clicking through a few pages I found this: http://support.webroot.com/app/answers/detail/a_id/1761 http://support.webroot.com/app/answers/detail/a_id/1761 which is susceptible to this vulnerability.
- china 14y agohttp://d204373.pem.kpn.net/applications/phpBB/config.php?-s http://d204373.pem.kpn.net/applications/phpBB/config.php?-s
- wanderr 14y agoAs has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.
- marklindhout 14y agoAbsolutely not. Lighttpd and Nginx both use it, and have recently picked up a lot of popularity because of it. It maybe an old mechanism, but it is fast, which is worth something these days :)
- gregbair 14y agoThose generally use FastCGI, which again, is not vulnerable.
- 1SaltwaterC 14y agonginx doesn't even have plain CGI support. The SimpleCGI wrapper does not count.
- micahshell 14y agoTheir is a fix here. http://pastebin.com/87sfaYL1 http://pastebin.com/87sfaYL1
- endijs 14y agoFrom Twitter: Stefan Esser @i0n1c The security emergency release to fix the PHP CGI RCE (that was tested for days...) does not fix anything at all.
- 0x0 14y agoHere is the fix that was applied: https://github.com/php/php-src/commit/55869a95ab75c0eb99c57201bfeccaef57e0d36d https://github.com/php/php-src/commit/55869a95ab75c0eb99c572... If the first char in the query string is "-" and the query string also contains "=", it skips cmdline argument option parsing. Maybe it is possible to construct a string not starting with "-", not containing "=", but containing a "+" followed by "-options" further out?
- sirclueless 14y agoNo, the problem is that they check the decoded query string for `=` signs, but Apache checks the raw query string. If you pass an encoded `=` anywhere in the query string then you can bypass the fix.
- rorrr 14y agoI don't think any major site uses mod_cgi.
- wvenable 14y agoThe problem is that the php-cgi script/binary accepts the same command line parameters as the regular php interpreter. This is clearly the wrong behavior and it's even explicitly documented as not doing that: http://www.php.net/manual/en/security.cgi-bin.attacks.php http://www.php.net/manual/en/security.cgi-bin.attacks.php "Accessing system files: http://my.host/cgi-bin/php?/etc/passwd http://my.host/cgi-bin/php?/etc/passwd The query information in a URL after the question mark (?) is passed as command line arguments to the interpreter by the CGI interface. Usually interpreters open and execute the file specified as the first argument on the command line. When invoked as a CGI binary, PHP refuses to interpret the command line arguments." Although this was actually in the documentation, Rasmus forgot why it was in there in the first place: http://thread.gmane.org/gmane.comp.php.devel/20745 http://thread.gmane.org/gmane.comp.php.devel/20745 Here is a legacy feature of CGI that hardly anybody knows about, using a setup of PHP that is already rare, targeting an issue already claimed to be solved! The perfect storm.
- dawkins 14y ago"we had a bug in our bug system that toggled the private flag of a bug report to public on a comment to the bug report causing this issue to go public before we had time to test solutions to the level we would like" Thats having a really bad day!
- caf 14y agoFrom the commit that introduced this bug: The point of the question here is if anybody remembers why we decided not to parse command line args for the cgi version? I could easily see it being useful to be able to write a cgi script like: #!/usr/local/bin/php-cgi -d include_path=/path <?php ... ?> and have it work both from the command line and from a web context. As far as I can tell this wouldn't conflict with anything, but somebody at some point must have had a reason for disallowing this. Perfectly illustrating the utility of well-chosen comments in code.
- EricR23 14y agoTo my knowledge, this vulnerability is anything but new. It's been around for years.
- trevorg75 14y agoHere's a fun fact...if you try this trick on http://facebook.com/ http://facebook.com/ you get the following source code <?php include_once 'https://www.facebook.com/careers/department?dept=engineering&req=a2KA0000000Lt8LMAS https://www.facebook.com/careers/department?dept=engineering...;
- mmcnickle 14y agoClever. I wonder if they have a tradition of having exploit easter eggs like this?
- savoy11 14y agoОк. There are bugs in the runtime, update and move on, drama queens.
- deleted 14y ago[deleted]