Page MenuHomePhabricator

PHP2Shell
Open, HighPublic

Description

A major PHP RCE vulnerability ("PHP2Shell") was recently disclosed. Phabricator is unsupported as of five years ago and I no longer recall how computers work, but I'm sure this'll be a quick fix and I can get back to collecting inoperable forklifts shortly.

So far:

  • I took down secure and Phacility services around 4AM Pacific.
  • secure is now back up and running on patched PHP, but I did this by upgrading everything forward. Phabricator itself is five years out of date and most pages are raising errors.

Revisions and Commits

Event Timeline

epriestley created this task.
epriestley added a revision: Restricted Differential Revision.Wed, Oct 21, 11:06 PM

Recent versions of Ubuntu default to a sudo implemented in Rust which doesn't support -E to pass the entire environment. A quick fix for this is to select sudo.ws as an alternative:

$ sudo update-alternatives --config sudo

Enumerating the entire environment explicitly is probably challenging (we often pass a bunch of per-VCS stuff which changes across versions and protocols, and I vaguely recall that SVN and Mercurial both have a lot of Env stuff going on at times). Enumerating it automatically by passing every key is possible, although kind of messy.

epriestley added a revision: Restricted Differential Revision.Thu, Oct 22, 12:46 AM
epriestley added a revision: Restricted Differential Revision.Thu, Oct 22, 2:13 AM