Discussion
RE: https://mastodon.social/@Edent/117483785620327786
“There isn't an easy exploit for this PHP vulnerability · Elias Taylor”
https://eliastaylor.com/noexploit/
> One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.
It looks like the PHP Armageddon bug may have been a bit overstated in that exploits require severe-level pre-existing vulnerabilities
If I'm to be completely honest, though, "has pre-existing severe code-level vulnerability" describes a lot of the PHP sites I've seen in the wild.
@baldur That's the thing - part of this being such a big event is that PHP itself is a cluster of a dev environment so the question of "does the site have another vulnerability?" is usually "probably" instead of "probably not"
And PHP is a cluster because back in the dotcom era software development decided that web development needed to prioritize being fast and cheap instead of engineered and decades later we're still constantly paying that price
@baldur That's just part of PHP's original DNA, no? (It may have evolved a great deal, but maybe not everyone followed suit.)
But it really also does look like anybody describing waves of exploits targeting their site yesterday or heroic work by their "agents" to safeguard their servers may be operating on the reality-deficient side of the bullshit scale.
This would seem to be a good example of how software is full of trade-offs where every choice is bad (starting with "using PHP", he jokes)
The bug seems to be hard to exploit but not fixing would give well resourced actors an incentive to find ways to use it
But the fix is also huge and results in a patch that's impossible to review, and so might well introduce a bunch of exploitable bugs on its own.
Clearly patching is the lesser of two evils, but clearly neither option is outright "good"
But my observation was primarily that many of the claims I've seen surface over the past day or so seem quite dubious in hindsight and seems to have led to a herd effect of sorts.
this article does not do a very good job of explaining their position imho, which is fine - they are just venting
some of the POCs *do* include example PHP code, but it seems to be basically calling unserialize to make it happen faster
if you look at the "anime girl" video, you will note that the attack is against certain WP/Wiki/etc endpoints, not usually root, as these are the easier routes in
the short path to the use-after-free is via file uploads, but this is not the only path, just the easiest one
that said, i have not seen a lot of independent confirmation of the core exploit either, so the idea has some merit, so until i feel like opening a VM and testing it myself the mystery will remain
Install Fedizen
Get the full app experience
@baldur Funny.
> The exploit video had an anime girl in it
Hahaha. I haven't seen it though (and now I've become quite positive that I won't)