Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP-FPM remote code execution bug exploited in the wild

github.com

Post reply on HN
Print view View original

1–10 of 139 posts

Re: PHP-FPM remote code execution bug exploited in the wild

#2

Post by kijin »

Ubuntu has a try_files directive in /etc/nginx/snippets/fastcgi-php.conf that is included by default. It was put there years ago to guard against another problem (also mentioned by OP), but it seems that the try_files directive will block this one, too.

Unfortunately, too many people still copy & paste three-liners from random blogs and call it a day, often overwriting the safe defaults provided by their distro, er, I mean, Debian/Ubuntu. (edit: The RPM world is a whole different beast. When you install typical LEMP components on CentOS 7, both MySQL and Memcached listen on all interfaces by default. Seriously?!)

Re: PHP-FPM remote code execution bug exploited in the wild

#3

Post by hnarn »

From the CVE:

> Solution

> On October 24, PHP 7.3.11 (current stable) and PHP 7.2.24 (old stable) were released to address this vulnerability along with other scheduled bug fixes. Those using nginx with PHP-FPM are encouraged to upgrade to a patched version as soon as possible.

> If patching is not feasible, the suggested workaround is to include checks to verify whether or not a file exists. This is achieved either by including the try_files directive or using an if statement, such as if (-f $uri).

Re: PHP-FPM remote code execution bug exploited in the wild

#7

Post by kijin »

thesorrow wrote: post #5

I'm sure a lot of PHP 7.0 installations are still in production and will not receive a patch...

They will receive a patch if they're using it on a Linux distro that is still supported (e.g. Ubuntu 16.04 LTS). How many people actually bother to run apt-get update && apt-get upgrade on their cloud servers or docker images is a different question, though.

Re: PHP-FPM remote code execution bug exploited in the wild

#8

Post by kgersen75 »

thesorrow wrote: post #5

I'm sure a lot of PHP 7.0 installations are still in production and will not receive a patch...

The issue is PHP-FPM (FastCGI) only and it's vulnerable from outside only with nginx.

The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx but Apache simply because people used 'apt install php' (or 'yum install php') to install it.

So imho, the impact is very limited.

Re: PHP-FPM remote code execution bug exploited in the wild

#9

Post by oefrha »

kijin wrote: post #7
thesorrow wrote: post #5

I'm sure a lot of PHP 7.0 installations are still in production and will not receive a patch...

They will receive a patch if they're using it on a Linux distro that is still supported (e.g. Ubuntu 16.04 LTS). How many people actually bother to run apt-get update && apt-get upgrade on their cloud servers or docker images is a different question, though.

Probably a good idea to auto install security updates. At least that’s what I do on my servers.
Post reply on HN