Page MenuHomePhabricator

SecurityTag
ActivePublic

Details

Description

Tasks related to enhancing the security of Phabricator.

Recent Activity

Yesterday

epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 11:21 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 11:18 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 11:14 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

One issue I'm struggling with is that some daemon parsing is failing...

Thu, Oct 22, 11:08 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 10:23 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 10:17 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

One issue I'm struggling with is that some daemon parsing is failing:

Thu, Oct 22, 10:13 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

Actually, Phabricator uses static::class since D21744 and it works in older PHP per 3v4l.org, so I think I'm incorrect that this requires PHP 8.

Thu, Oct 22, 9:35 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 9:32 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

See T13637. See T13588. In PHP 8.1, the behavior of static variables in methods changed, per this snippet from the PHP Documentation:

Thu, Oct 22, 9:19 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 8:59 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 8:44 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 8:25 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

I do want $array[null] to kill the server in the general case so all the high-quality Phabricator code I write in the future can't do it, but I realize I may need to concede and silence the error. I am going to give up on this one:

Thu, Oct 22, 7:09 PM · Security, Phacility
avivey added a comment to T13704: PHP2Shell.

also maybe copy https://we.phorge.it/D25387, which makes it so deprecation
messages don't kill the server.

Thu, Oct 22, 7:04 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.
  • AWS now has over 800 instance types???
  • I believe I've launched a new admin with a patched PHP that is surviving a least some of the deployment process. MySQL can't upgrade databases across major versions, so I'm restoring from backup now.
  • @jmeador oh hi there
  • @avivey Yeah, like half the pages are working for me while logged in but things are still pretty rough.
Thu, Oct 22, 7:04 PM · Security, Phacility
avivey added a comment to T13704: PHP2Shell.

Hi Evan,

Thu, Oct 22, 6:52 PM · Security, Phacility
jmeador added a comment to T13704: PHP2Shell.

A wild epriestley appears!

Thu, Oct 22, 6:33 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

Typical state-of-the-art software upgrade process:

Thu, Oct 22, 5:52 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:46 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:20 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:11 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 3:09 PM · Security, Phacility
epriestley added a comment to T13704: PHP2Shell.

General state of affairs:

Thu, Oct 22, 2:46 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 2:28 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 9:58 AM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 9:20 AM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 2:13 AM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Thu, Oct 22, 12:46 AM · Security, Phacility

Wed, Oct 21

epriestley added a comment to T13704: PHP2Shell.

Recent versions of Ubuntu default to a sudo implemented in Rust which doesn't support -E to pass the entire environment. A quick fix for this is to select sudo.ws as an alternative:

Wed, Oct 21, 11:09 PM · Security, Phacility
epriestley added a revision to T13704: PHP2Shell: Restricted Differential Revision.
Wed, Oct 21, 11:06 PM · Security, Phacility
epriestley triaged T13704: PHP2Shell as High priority.
Wed, Oct 21, 10:44 PM · Security, Phacility
epriestley triaged T13704: PHP2Shell as High priority.
Wed, Oct 21, 10:44 PM · Security, Phacility

Oct 26 2022

epriestley closed T13683: Security Guidance: References to Files in Remarkup as Resolved.

There are some remaining non-security bugs with this that I'll follow up on in T13682. I believe the security side of this is now resolved.

Oct 26 2022, 8:03 PM · Guides, Files, Security
epriestley added a comment to T13683: Security Guidance: References to Files in Remarkup .

The details of this attack will be disclosed at a later date, once installs have had some sort of plausible chance to upgrade.

Oct 26 2022, 8:01 PM · Guides, Files, Security

May 27 2022

epriestley triaged T13683: Security Guidance: References to Files in Remarkup as Normal priority.
May 27 2022, 6:13 PM · Guides, Files, Security

May 17 2022

epriestley closed T13681: Ancient "feed.publish" API is (at best) long obsolete, and arguably exploitable as Resolved.
May 17 2022, 11:31 PM · Security, Feed
epriestley added a revision to T13681: Ancient "feed.publish" API is (at best) long obsolete, and arguably exploitable: Restricted Differential Revision.
May 17 2022, 11:29 PM · Security, Feed
epriestley triaged T13681: Ancient "feed.publish" API is (at best) long obsolete, and arguably exploitable as Normal priority.
May 17 2022, 11:27 PM · Security, Feed

May 9 2022

epriestley closed T13679: Non-administrators can incorrectly edit default global settings as Resolved.

I believe D21811 covers this completely.

May 9 2022, 10:19 PM · Security
epriestley updated the task description for T13679: Non-administrators can incorrectly edit default global settings.
May 9 2022, 10:18 PM · Security
epriestley added a revision to T13679: Non-administrators can incorrectly edit default global settings: Restricted Differential Revision.
May 9 2022, 10:10 PM · Security
epriestley triaged T13679: Non-administrators can incorrectly edit default global settings as Normal priority.
May 9 2022, 10:08 PM · Security

Apr 29 2022

mormegil added a comment to T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation.

Just for visibility, this is I believe the change that broke Diffusion (which was fixed in rP52df4ff515b7), where the error message is something like

Apr 29 2022, 8:19 AM · Git, Security

Apr 20 2022

epriestley closed T13589: Git may interpret refnames as flags in some commands which accept both refs and paths as Resolved.

I believe these were all hunted down.

Apr 20 2022, 7:15 PM · Security, Git
epriestley added a revision to T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation: Restricted Differential Revision.
Apr 20 2022, 4:31 PM · Git, Security

Apr 14 2022

epriestley closed T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation as Resolved.

I deployed this everywhere in the Phacility cluster yesterday and things have been quiet, so I'm assuming it worked until evidence arises to the contrary.

Apr 14 2022, 1:49 PM · Git, Security
epriestley updated the task description for T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation.
Apr 14 2022, 1:47 PM · Git, Security

Apr 13 2022

epriestley added a comment to T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation.

D21756 effectively makes all Git pathways call setSudoAsDaemon(true).

Apr 13 2022, 6:31 PM · Git, Security
epriestley added a comment to T13673: CVE-2022-24765 - Multi-user Git Privilege Escalation.

Just for visibility, the error messages you'll see if you're affected by this issue look something like this:

Apr 13 2022, 6:06 PM · Git, Security