I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796
Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?
Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
Yes the vulns are real. No that does not mean a system with the vuln is automatically and noticeably exploitable: that assumes there are no other defense systems or simply other happenstance logical walls around (firewalls, datacenter range blocks, seven proxies, 28 NATs, Anubis, whathaveyou).
My understanding is that CVEs are ranked not by Real World conditions but rather under an “idealized threat condition” that imagines your machine is essentially connected with a straight wire to the root DNS serves of the internet, given a public IPv4 address, and the off switch is dislodged or somehow made unavailable.
I don’t think any of those walls help except for a WAF that knows what to look for. I don’t know exactly what the real exploits look like but I heard something about constructing multipart form bodies that expand to a surprisingly large amount of PHP memory compared to the size of the request body, and that’s probably something a heuristic on a WAF could detect. I would want to do more research before relying on that.
So a multipart form “zip bomb”? Sounds like the kind of thing that would do… well, that. But also, by that point you don’t even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.
(Not that I’d rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)