| ▲ | Operyl 7 hours ago |
| I can guarantee you that it's not because someone left system() enabled, it's much lower than that. |
|
| ▲ | jeffbee 5 hours ago | parent [-] |
| What is lower than what? This exploit causes the flow of control to reach zend_call_function with the argument "system". It works at the PHP level and having disabled that function is an absolute defense against the exploit. It isn't 1998 any more and you can no longer just inject shell code on the heap. |
| |
| ▲ | Operyl 5 hours ago | parent | next [-] | | The current PoC in the public gets there via that method, and even then you don't need to call system() alone to cause hell on a host... | | |
| ▲ | jeffbee 5 hours ago | parent [-] | | The point of this thread, and of defense in depth generally, is to limit the scale of "hell" and to trivialize the impact of "on the host". | | |
| ▲ | Operyl 5 hours ago | parent [-] | | Look, at the end of the day, every major security researcher is going "oh shit" and no amount of tweaks to your configuration is going to limit the blast radius in a way that will actually matter. You're going to need to update PHP, that's the _only_ solution to this problem. |
|
| |
| ▲ | 5 hours ago | parent | prev [-] | | [deleted] |
|
