This is and update on the php2shell vulnerability and a response to the blog post from https://lemmy.world/post/53441818 : https://eliastaylor.com/noexploit/
You must log in or register to comment.
- erock@lemmy.worldEnglish2 days
Oh hey, it’s my comment on HN they pointed to as having anti ai psychosis, ama
- Zwuzelmaus@feddit.orgEnglish5 days
I guess nearly everybody has installed the patch by now. Even myself :)
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unpatched servers…
5 daysI guess nearly everybody has installed the patch by now
I admire your belief ;)
ATM almost 80% of scanned services are still vulnerable. Considering that
**About 54% of PHP services hide their version** and are not counted as affected or patched.it doesn’t look too good- stuner@lemmy.worldEnglish5 days
Yeah, assuming everyone installed the patch is quite optimistic. But censys probably also undercounts the number of fixed systems, as some Linux distros (e.g., Ubuntu) don’t change the version when shipping security fixes. I’m running the sury.org package which would report as 7.4.33 but has been patched. Still it looks like there’s tons of unpatched services.
- stuner@lemmy.worldEnglish5 days
Yes, hopefully most people had time to install the updates. And maybe the false exploit reports helped slow down malicious people too.
- Thaurin@lemmy.worldEnglish5 days
Don’t people use unattended upgrades? Crowdsec’s WAF AppSec or Cloudfare’s WAF also put out patches that would’ve caught these vulnerabilities before the official PHP patches were released.
Of course, those normally run once per 24 hours, which is a little late…
- stuner@lemmy.worldEnglish5 days
It would be interesting to know what share of servers have that enabled.
I have it enabled on Debian and Ubuntu and I’m quite happy with it. But I had pretty bad experiences with reboot-less updates on other (desktop) distros.
- Thaurin@lemmy.worldEnglish5 days
I think Debian is probably pretty conservative in their updates. I also recommend checking out the needrestart package. It will tell you when a reboot is needed because of a newer kernel that was installed, or when a systemd service needs a restart.
But as another commenter noted, outside of self hosting, in enterprise businesses environments where you manage an army of servers, things look different. But then, these guys are paid to be on-call in the weekend for events like these. :)
- non_burglar@lemmy.worldEnglish5 days
The path to uptime is paved with understanding what broke and when.
- Zwuzelmaus@feddit.orgEnglish5 days
Don’t people use unattended upgrades?
php can be a real nightmare even with it’s well-attended upgrades :)
- Thaurin@lemmy.worldEnglish5 days
Well, we’re talking (Debian’s) security updates only here, not major PHP version jumps. :)
- Luckyfriend222@lemmy.worldEnglish5 days
No. Unattended upgrades are a nightmare in production. If you patch stuff manually or even with ansible, you can see what the hell broke during the upgrade. Whereas with unattended access you walk in Monday morning with half your systems down and no idea which update broke it.
- frongt@lemmy.zipEnglish5 days
Unattended application to test. If it passes testing, unattended application to prod.
I still wouldn’t do this for any critical service, but for a “move fast and break things” system like Facebook where it goes down and nothing bad happens, sure.
- Thaurin@lemmy.worldEnglish5 days
Yeah, for businesses I can see that, but selfhosting, meh. I have just one personal server firewalled and Wireguarded, so the PHP vulnerability wasn’t even publicly exposed. Even so, I have never had any issues with Debian’s unattended security upgrades in the last 5 years.
In enterprise environments with a hundred servers, though, you will want to do something else than I do. :)
But even then, don’t enterprises run a good WAF in front of their public web sites that would have received the patch automatically?
- needanke@feddit.orgEnglish5 days
For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).
But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities when a fix exists.
- Helix 🧬@feddit.orgEnglish5 days
Maybe we are going to see “scanner” websites for such patch situations in the future, with a world map and statistics where are how many unpatched servers…
You mean things that already exist, like https://shodan.io/?
- Zwuzelmaus@feddit.orgEnglish5 days
I don’t know. What does it tell about patches on servers (who don’t easily show their internals in such detail)?
- SteveTech@aussie.zoneEnglish5 days
Some servers do publically list their PHP version, and as an example there are currently ~23,000 that list PHP 8.5.11: https://www.shodan.io/search?query=PHP%2F8.5.11
Sure these could be a manually patched version of 8.5.11, but I find that pretty unlikely.
- stuner@lemmy.worldEnglish5 days
So it seems like it was rather easy for an IT security professional to create an exploit within 24h of the disclosure. Not sure if every script kiddy can do it, but this means that there are certainly malicious people/organizations who can.
Ultimately, it seems to me that the only real choice is to patch our (public) systems ASAP these days.
- 5 days
Besides the problem of people being able to do this themselves, there’s the problem of people who develop and sell, or sometimes give away, exploits. The people scrambling to publish POCs without verifying that they’re demonstrating the right vulnerabilities are unintentionally helping out by making it difficult to find how to exploit the real vulnerabilities. Like what are you supposed to search for “php2shell exploit for real not fake?” You almost need an AI agent in a sandbox to download and run all the POCs to weed out the fake ones until one of them becomes well known.
- stuner@lemmy.worldEnglish5 days
Agreed.
You almost need an AI agent in a sandbox to download and run all the POCs to weed out the fake ones until one of them becomes well known.
Sounds like a good malware vector to target security researchers…
