upvote

points

by grey-area13 hours ago |
comments
upvoteby athrowaway3z12 hours ago|
next
[-]
I too have various websites that dont get hacked.

I'm not sure what this page proves except that not all set-ups are in danger. Especially if the site does nothing and has a nginx in front that caps all requests to 1mb.

There are, afaict, at least half a dozen choices a PHP server could have made that mitigates all (known) exploits. Putting some bitcoins behind one of them isn't exactly proof of anything, except as a PR stunt to convince people PHP is not a pile of tightly coupled hot-c garbage.

---

Other projects that get CVEs talk about what went wrong and how to improve. So far i've only seen PHP people defensive and telling each other that ok because other projects also get CVEs.

reply
upvoteby zkldi12 hours ago|
parent|
[-]
Hey, you're leaving out that nginx's default is to cap at 1m, btw.
reply
upvoteby athrowaway3z12 hours ago|
parent|
[-]
The Dutch government websites that went down have multiple endpoints to upload files that do not have a 1MiB cap.
reply
upvoteby zkldi12 hours ago|
parent|
next
[-]
But the Dutch government websites do generally (I hope) have users, which is one of the ways the "I need to hit the same php worker, uninterrupted, for about 10 to 30 seconds while absolutely no other traffic hits the site AND I can isolate the one worker from the pool" approach to exploiting fails.

Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server.

However, is this really that exploitable in real world conditions? (no)

reply
upvoteby athrowaway3z5 hours ago|
parent|
[-]
"There does not exists" and "I've not heard off" are different things. This is motivated reasoning on your part to tell the story that this isn't a big deal.

Most variants require a few requests to infer some settings, and then they can spam their arming-stage, and then their exploit stage. Granted, its not quite as easy as that, but hitting _a_ worker twice on a server once is not all that lucky.

Also, 03:00 at night is not a busy time.

reply
upvoteby grey-area5 hours ago|
parent|
prev|
[-]
So according to you they could have just imposed an upload cap instead and been safe? If all the cybersecurity experts had given useful advice like that earlier in the week people could have been safer and less panicked.
reply
upvoteby TZubiri9 hours ago|
prev|
next
[-]
> I think there's still going to be a massive long tail of sites that will never be protected or upgraded,

Ok? But that's super common, and there's thousands of ways to exploit unmaintained systems, nothing special about this.

From a technical level as well, this is not an easy bug to exploit, it's CVSS Attack Complexity:High, it requires a lot of per-target work, it's definitely not copy.fail level

reply
upvoteby grey-area54 minutes ago|
parent|
[-]
I think we’re saying the same thing - at this stage there’s not much point in withholding details, That’s why I brought up the sites that will never patch - that’s normal and at some point it helps more to release more details.
reply
upvoteby hparadiz12 hours ago|
prev|
[-]
Shared host Wordpress sites basically run in unprotected untrusted mode since WP has so many RCEs already and they can be in any random plugin someone adds at any time. So even if there's an RCE a lot of these sites just shrug at the attack. You would need to figure out how to chain it for something useful.
reply