3 ms·
The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?
by Incipient 1y ago
The idea here is you can trigger a server to run the "safe" php file, then send it the webshell version, which passes hash based scanning?
- chipsrafferty 1y agoYes, but you'd need a situation where: 1. You can upload scripts that get scanned for malicious code 2. These scripts can be executed once deemed "safe" 3. The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it 3. Is where the issue is. It should probably always re-scan it and it definitely should not be using MD5.
- szszrk 1y agoIs there any fairly popular software that still uses md5 in this context? Most I've seen (sec scans, backup validation/dedup etc) pushed to phase out md5 very long time ago.
- h33t-l4x0r 1y agoWordpress uses md5 checksums for core files. That doesn't make it vulnerable to this, except in the sense that it kind of validates using them.
- IshKebab 1y agoThere's no need to rescan. You just need to use a secure hash.
- jgalt212 1y agoSecure for now, rather. A solid game plan would be to have your code base set up to easily swap in a new hashing method when called for. I believe Django automatically promotes passwords stored with insecure hashes to secure ones the next time a user logs in.
- IshKebab 1y agoYeah not really an issue for a cache since you can just invalidate the cache when you change algorithm.
- falcor84 1y ago>The server is using MD5 hashes to determine if you uploaded the same file or if it should re-scan it Wouldn't the sensible thing for a server that gets an upload matching an existing file's hash be to just treat it as an idempotent no-op? What reason would it have to replace the old version with a presumably identical copy? What am I missing?
- dnet 1y agoI assume the scanner is a separate library/service that receives the contents and returns a boolean safe/malicious result, and the implementation using MD5 to avoid expensive re-scans is an internal detail hidden from the caller.
- sim7c00 1y agothe safe file is not a valid php file? it might be executed if php is like javascript ignorning valid chars, but i doubt something actually 'looking at it' would accept it as benign or valid.