Page MenuHomePhabricator

SecurityTag
ActivePublic

Details

Description

Tasks related to enhancing the security of Phabricator.

Recent Activity

Today

epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Fri, Oct 23, 4:30 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

Found one, creating a new project returns:

Fri, Oct 23, 4:26 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Fri, Oct 23, 4:23 PM · Security, Phacility
holmboe added a comment to T13704: PHP2Shell.

Found one, creating a new project returns:

Fri, Oct 23, 3:30 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

I suspect a lot of behavior is still broken, but at least some things should be working now. I'm working on restoring SSH access to repositories (which I suspect is just an ops/config issue) and then I'll fix whatever shows up in the error log.

Fri, Oct 23, 3:23 PM · Security, Phacility
holmboe added a comment to T13704: PHP2Shell.

We are live! Thank you Evan for your relentless work. 🙏

Fri, Oct 23, 3:17 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Fri, Oct 23, 3:16 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.
  • Restoring MySQL from backup took a very long time (partly because I didn't realize the volume was an ancient gp2 volume with a tight limit on iops) but succeeded.
  • admin is back up and cluster directory services are mostly working.
  • I'm working on redeploying web now; this tier is stateless and doesn't need to load backups.
  • The most recent available backup was slightly out of date (Oct 16th IIRC). If this caused issues (e.g., double-billing or deleting recently-invited user accounts) I'll sort everything out once services are back up.
Fri, Oct 23, 3:01 PM · Security, Phacility

Yesterday

epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 11:21 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 11:18 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 11:14 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

One issue I'm struggling with is that some daemon parsing is failing...

Thu, Oct 22, 11:08 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 10:23 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 10:17 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

One issue I'm struggling with is that some daemon parsing is failing:

Thu, Oct 22, 10:13 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

Actually, Phabricator uses static::class since D21744 and it works in older PHP per 3v4l.org, so I think I'm incorrect that this requires PHP 8.

Thu, Oct 22, 9:35 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 9:32 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

See T13637. See T13588. In PHP 8.1, the behavior of static variables in methods changed, per this snippet from the PHP Documentation:

Thu, Oct 22, 9:19 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 8:59 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 8:44 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 8:25 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

I do want $array[null] to kill the server in the general case so all the high-quality Phabricator code I write in the future can't do it, but I realize I may need to concede and silence the error. I am going to give up on this one:

Thu, Oct 22, 7:09 PM · Security, Phacility
avivey added a comment to T13704: PHP2Shell.

also maybe copy https://we.phorge.it/D25387, which makes it so deprecation
messages don't kill the server.

Thu, Oct 22, 7:04 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.
  • AWS now has over 800 instance types???
  • I believe I've launched a new admin with a patched PHP that is surviving a least some of the deployment process. MySQL can't upgrade databases across major versions, so I'm restoring from backup now.
  • @jmeador oh hi there
  • @avivey Yeah, like half the pages are working for me while logged in but things are still pretty rough.
Thu, Oct 22, 7:04 PM · Security, Phacility
avivey added a comment to T13704: PHP2Shell.

Hi Evan,

Thu, Oct 22, 6:52 PM · Security, Phacility
jmeador added a comment to T13704: PHP2Shell.

A wild epriestley appears!

Thu, Oct 22, 6:33 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

Typical state-of-the-art software upgrade process:

Thu, Oct 22, 5:52 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:46 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:20 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:11 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:09 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

General state of affairs:

Thu, Oct 22, 2:46 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 2:28 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 9:58 AM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 9:20 AM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 2:13 AM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 12:46 AM · Security, Phacility

Wed, Oct 21

epriestley added a comment to T13704: PHP2Shell.

Recent versions of Ubuntu default to a sudo implemented in Rust which doesn't support -E to pass the entire environment. A quick fix for this is to select sudo.ws as an alternative:

Wed, Oct 21, 11:09 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Wed, Oct 21, 11:06 PM · Security, Phacility
epriestley triaged T13704: PHP2Shell as High priority.
Wed, Oct 21, 10:44 PM · Security, Phacility
epriestley triaged T13704: PHP2Shell as High priority.
Wed, Oct 21, 10:44 PM · Security, Phacility

Oct 26 2022

epriestley closed T13683: Security Guidance: References to Files in Remarkup as Resolved.

There are some remaining non-security bugs with this that I'll follow up on in T13682. I believe the security side of this is now resolved.

Oct 26 2022, 8:03 PM · Guides, Files, Security
epriestley added a comment to T13683: Security Guidance: References to Files in Remarkup .

The details of this attack will be disclosed at a later date, once installs have had some sort of plausible chance to upgrade.

Oct 26 2022, 8:01 PM · Guides, Files, Security

May 27 2022

epriestley triaged T13683: Security Guidance: References to Files in Remarkup as Normal priority.
May 27 2022, 6:13 PM · Guides, Files, Security

May 17 2022

epriestley closed T13681: Ancient "feed.publish" API is (at best) long obsolete, and arguably exploitable as Resolved.
May 17 2022, 11:31 PM · Security, Feed
epriestley added a revision to T13681: Ancient "feed.publish" API is (at best) long obsolete, and arguably exploitable: Restricted Differential Revision.
May 17 2022, 11:29 PM · Security, Feed
epriestley triaged T13681: Ancient "feed.publish" API is (at best) long obsolete, and arguably exploitable as Normal priority.
May 17 2022, 11:27 PM · Security, Feed

May 9 2022

epriestley closed T13679: Non-administrators can incorrectly edit default global settings as Resolved.

I believe D21811 covers this completely.

May 9 2022, 10:19 PM · Security
epriestley updated the task description for T13679: Non-administrators can incorrectly edit default global settings.
May 9 2022, 10:18 PM · Security
epriestley added a revision to T13679: Non-administrators can incorrectly edit default global settings: Restricted Differential Revision.
May 9 2022, 10:10 PM · Security