New PHP Vulnerability:?-s may expose source code for mod_cgi

Post by MartinodF » Fri, May 04, 2012, 12:23 AM UTC

caf wrote: post #40

From the commit that introduced this bug: The point of the question here is if anybody remembers why we decided not to parse command line args for the cgi version? I could easily see it being useful to be able to write a cgi script like: #!/usr/local/bin/php-cgi -d include_path=/path and have it work both from the command line and from a web context. As far as I can tell this wouldn't conflict with anything, but some…

Post by jQueryIsAwesome » Fri, May 04, 2012, 1:06 AM UTC

arondeparon wrote: post #18

fusiongyro wrote: post #8

Earlier quoted context omitted.

Yeah, but nobody's run PHP in this silly CGI configuration for 10 years.

Dutch ISP KPN actually has a hosting service that runs PHP primarily in CGI mode: https://www.google.com/#hl=en&output=search&sclient=... yields a massive amount of vulnerable sites.

Post by sirclueless » Fri, May 04, 2012, 1:11 AM UTC

0x0 wrote: post #34

endijs wrote: post #27

From Twitter: Stefan Esser ‏ @i0n1c The security emergency release to fix the PHP CGI RCE (that was tested for days...) does not fix anything at all.

Here is the fix that was applied: https://github.com/php/php-src/commit/55869a95ab75c0eb99c572... If the first char in the query string is "-" and the query string also contains "=", it skips cmdline argument option parsing. Maybe it is possible to construct a string not starting with "-", not containing "=", but containing a "+" followed by "-options" further out?

Post by rmccue » Fri, May 04, 2012, 1:24 AM UTC

mikey_p wrote: post #35

devicenull wrote: post #26

Earlier quoted context omitted.

FastCGI makes little to no sense on shared web hosting machines. With FastCGI, each user on the machine needs at least one long-running process to handle requests. This is a waste when you consider that large numbers of the sites may be idle 99% of the time. With CGI, you only have PHP processes running when they are actually handling requests, it's really a much better solution for shared hosting.

With PHP 5.3.9 or 5.3.10 and php-fpm a new method of process management called ondemand was introduced that handles this use care very well. With a super short idle timeout (a few seconds) this could work very well for shared hosting, but I doubt there are many folks using it since it does still require the process manager to stay running in order to start the workers (this makes it hard to have user configurable php…

Post by yahelc » Fri, May 04, 2012, 2:17 AM UTC

TazeTSchnitzel wrote: post #16

Huh. I'd used that method of passing in parameters, mistakenly thinking it was the correct way to get a query string. Then I asked on SO and found out I was doing things horribly, horribly wrong.