Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP-FPM remote code execution bug exploited in the wild

github.com

Post reply on HN
Print view View original

41–50 of 139 posts

Re: PHP-FPM remote code execution bug exploited in the wild

#41

Post by heavyset_go »

thesorrow wrote: post #17

FYI : If you have a NextCloud or Owncloud installation. The recommended nginx configuration is vulnerable [1] [1] https://nextcloud.com/blog/urgent-security-issue-in-nginx-ph...

This is a case study in why you shouldn't expose your self-hosted services to the internet.

Re: PHP-FPM remote code execution bug exploited in the wild

#42

Post by zubspace »

Can someone confirm, that it will still take 6 days until fedora servers get patched, except if i get it from testing? [1] Is this the norm for CVE's ? How long does it take other distros to patch?

Also: Am I secure if i run PHP 7.2.24 or do I need to change the configs?

[1] https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae312...

Re: PHP-FPM remote code execution bug exploited in the wild

#43

Post by maxymajzr »

wolco wrote: post #30
stephenr wrote: post #27

Earlier quoted context omitted.

Why are you not running php-fpm with Apache is a more pressing question IMO.

Speed mostly.

Can you elaborate? I've yet to see Apache + mod_php to be capable of coming even close to + PHP-FPM so I'm really interested in what you guys are doing.

Re: PHP-FPM remote code execution bug exploited in the wild

#44

Post by tetha »

Hmm, so looking at the exploit and the patch... do I read it right: There is a buffer underflow in php-fpm if the environment variables SCRIPT_FILENAME and PATH_INFO have a state that violates an assumption. And currently a widespread configuration of nginx + php-fpm is configured such that the URL can be suffiently mangled such that nginx sets these parameters in a violating manner.

However, that means anything utilizing php-fpm in this version remains vulnerable, and it's just unknown if or how apache + php-fpm, or other reverse proxies for php-fpm are vulnerable - right?

So while I don't need to panic right now, I'll certainly have to take a look at our setups running php-fpm on monday.

Re: PHP-FPM remote code execution bug exploited in the wild

#45

Post by kuzimoto »

heavyset_go wrote: post #41
thesorrow wrote: post #17

FYI : If you have a NextCloud or Owncloud installation. The recommended nginx configuration is vulnerable [1] [1] https://nextcloud.com/blog/urgent-security-issue-in-nginx-ph...

This is a case study in why you shouldn't expose your self-hosted services to the internet.

I have been thinking about this a lot lately. What is the best alternative, only accessing your services through a VPN?

Re: PHP-FPM remote code execution bug exploited in the wild

#46

Post by PureParadigm »

kuzimoto wrote: post #45
heavyset_go wrote: post #41

Earlier quoted context omitted.

This is a case study in why you shouldn't expose your self-hosted services to the internet.

I have been thinking about this a lot lately. What is the best alternative, only accessing your services through a VPN?

I've transitioned all my self-hosted services to behind a Wireguard VPN. This even includes SSH, so there are no ports exposed except the UDP port for Wireguard.

Re: PHP-FPM remote code execution bug exploited in the wild

#47

Post by noja »

heavyset_go wrote: post #41
thesorrow wrote: post #17

FYI : If you have a NextCloud or Owncloud installation. The recommended nginx configuration is vulnerable [1] [1] https://nextcloud.com/blog/urgent-security-issue-in-nginx-ph...

This is a case study in why you shouldn't expose your self-hosted services to the internet.

No it's not.

Re: PHP-FPM remote code execution bug exploited in the wild

#48

Post by heavyset_go »

kuzimoto wrote: post #45
heavyset_go wrote: post #41

Earlier quoted context omitted.

This is a case study in why you shouldn't expose your self-hosted services to the internet.

I have been thinking about this a lot lately. What is the best alternative, only accessing your services through a VPN?

VPN or SSH tunnels. I just use WireGuard these days.

Re: PHP-FPM remote code execution bug exploited in the wild

#49

Post by mantoto »

tetha wrote: post #44

Hmm, so looking at the exploit and the patch... do I read it right: There is a buffer underflow in php-fpm if the environment variables SCRIPT_FILENAME and PATH_INFO have a state that violates an assumption. And currently a widespread configuration of nginx + php-fpm is configured such that the URL can be suffiently mangled such that nginx sets these parameters in a violating manner. However, that means anything util…

On Monday?

Assume your systems are compromised and act accordingly.

Re: PHP-FPM remote code execution bug exploited in the wild

#50

Post by UnoriginalGuy »

heavyset_go wrote: post #41
thesorrow wrote: post #17

FYI : If you have a NextCloud or Owncloud installation. The recommended nginx configuration is vulnerable [1] [1] https://nextcloud.com/blog/urgent-security-issue-in-nginx-ph...

This is a case study in why you shouldn't expose your self-hosted services to the internet.

Google has gone the opposite direction.

I feel like throwing everything behind a VPN and pretending it is secure is a crux.

Several famous break-ins over the last ten years have hypothetically been on the inside of that wall.

Better to isolate services from each other limiting cross service jumping, than to build security around a single point of failure.

Post reply on HN