PHP-FPM remote code execution bug exploited in the wild • Hacker News Board

Re: PHP-FPM remote code execution bug exploited in the wild

#21

Post by makomk » Sun, Oct 27, 2019, 5:01 PM UTC

tyingq wrote: post #14

jstanley wrote: post #12

The exploit requires > fastcgi_split_path_info ^(.+?\.php)(/.*)$; If I'm not using this feature of PHP, what can I put in this config value to prevent the exploit from working?

I don't think you can fix it there, because you probably need stuff like /foo.php?key=value to work. (Edit: not quite...see comment below) The try_files config mentioned on the page mitigates the issue.

I don't think this line is required to make foo.php?key=value to work, because the query parameters aren't treated as part of the path. It's for URLs like foo.php/bar where you have some path after the PHP file that's passed to the script - this was supported out the box by Apache mod_php and there's a fair amount of code out there that relies on it. (Generally because cleaner methods of feeding a set of paths to one PHP script require server configuration that may not be available on cheap shared web hosting.)

Re: PHP-FPM remote code execution bug exploited in the wild

#22

Post by oefrha » Sun, Oct 27, 2019, 5:22 PM UTC

wolco wrote: post #15

cbg0 wrote: post #11

Earlier quoted context omitted.

> The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx Do you have a source for this?

Common approach is to serve static files with nginx and use apache / php_mod to process. Why are you running php-fpm? Do you need to separate request's processes? The speed benefits of php-fpm are part of php 7 so using php_mod is faster now.

> Why are you running php-fpm?

Because running just nginx is more convenient than nginx + Apache, where Apache is only used for mod_php. For me anyway. (I only use nginx + php-fpm for a Wordpress instance; I have tons of stuff in other languages running on top of nginx too.)

Re: PHP-FPM remote code execution bug exploited in the wild

#23

Post by orf » Sun, Oct 27, 2019, 5:23 PM UTC

The commit that fixes it: https://github.com/php/php-src/commit/ab061f95ca966731b1c84c...

Re: PHP-FPM remote code execution bug exploited in the wild

#24

Post by cbg0 » Sun, Oct 27, 2019, 5:31 PM UTC

wolco wrote: post #15

cbg0 wrote: post #11

Earlier quoted context omitted.

> The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx Do you have a source for this?

Common approach is to serve static files with nginx and use apache / php_mod to process. Why are you running php-fpm? Do you need to separate request's processes? The speed benefits of php-fpm are part of php 7 so using php_mod is faster now.

> Common approach is to serve static files with nginx and use apache / php_mod to process.

Not sure how common that really is, I've personally never set things up like that and just use nginx + php-fpm and don't know anyone that still uses apache with mod_php.

Re: PHP-FPM remote code execution bug exploited in the wild

#25

Post by samat » Sun, Oct 27, 2019, 5:35 PM UTC

For those of you not speaking Russian, Russian for ‘dick’ & ‘cunt’ (also meaning ‘something very bad happening’) are in the title.

Re: PHP-FPM remote code execution bug exploited in the wild

#26

Post by shakna » Sun, Oct 27, 2019, 5:50 PM UTC

wolco wrote: post #15

cbg0 wrote: post #11

Earlier quoted context omitted.

> The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx Do you have a source for this?

Common approach is to serve static files with nginx and use apache / php_mod to process. Why are you running php-fpm? Do you need to separate request's processes? The speed benefits of php-fpm are part of php 7 so using php_mod is faster now.

PHP-FPM + Nginx is the standard approach for OwnCloud & NextCloud. I'm sure they're not the only stacks that use that approach.

Re: PHP-FPM remote code execution bug exploited in the wild

#27

Post by stephenr » Sun, Oct 27, 2019, 5:58 PM UTC

wolco wrote: post #15

cbg0 wrote: post #11

Earlier quoted context omitted.

> The vast majority of PHP 7.0 installations don't use FastGCI and don't use nginx Do you have a source for this?

Common approach is to serve static files with nginx and use apache / php_mod to process. Why are you running php-fpm? Do you need to separate request's processes? The speed benefits of php-fpm are part of php 7 so using php_mod is faster now.

Why are you not running php-fpm with Apache is a more pressing question IMO.

Re: PHP-FPM remote code execution bug exploited in the wild

#28

Post by arpa » Sun, Oct 27, 2019, 6:02 PM UTC

Luckily, php 7.1 has still left a month for security fixes.

This is patched in 7.1.33.

Re: PHP-FPM remote code execution bug exploited in the wild

#29

Post by throwawayRO1999 » Sun, Oct 27, 2019, 6:06 PM UTC

samat wrote: post #25

For those of you not speaking Russian, Russian for ‘dick’ & ‘cunt’ (also meaning ‘something very bad happening’) are in the title.

In Romanian as well

Re: PHP-FPM remote code execution bug exploited in the wild

#30

Post by wolco » Sun, Oct 27, 2019, 6:11 PM UTC

stephenr wrote: post #27

wolco wrote: post #15

Earlier quoted context omitted.

Common approach is to serve static files with nginx and use apache / php_mod to process. Why are you running php-fpm? Do you need to separate request's processes? The speed benefits of php-fpm are part of php 7 so using php_mod is faster now.

Why are you not running php-fpm with Apache is a more pressing question IMO.

Speed mostly.