"No successful PHP2Shell exploits seen so far"... in the wild, specifically in Wiz's honeypot. The vulnerability itself has been successfully exploited, most notably for the "Steal my Bitcoin" challenge [1] as one example.
Dan Guido, of Trail of Bits, claims they have an "universal" exploit [2]. Knowing their track record, I don't currently have a reason to doubt this claim.
It's funny that when stealmybitcoin.com was posted on HN (https://news.ycombinator.com/item?id=50224916) there were hundreds of top voted comments saying "see no one has been able to steal it, the reported vulnerability was fake, it's all AI marketing" etc.
Since it was successfully exploited there has been zero further discussion, and I bet most people who participated in the original thread aren't even aware.
IIUC, the first setup couldn't be exploited because the site didn't run any php. You kinda need the server to run some php if you're gonna use a php vuln. It got solved ~2h after they added a php-version.php ...
Just last week companies were saying php2shell has been rampant for months, but if that were the case, wouldn't we all have strange errors in our logs? Something seems fishy to me.
What does being from a particular country have to do with a verified CVE?
It’s not like it was their first rodeo and they got lucky. There are lots of competent security companies located in countries all around the world, including ones you may not politically agree with.
This has been my hyperfixation for the last few days, and I've been trying to keep together a detailed and timestamped timeline of the evolving situation:
TLDR is multiple entries that show successful exploitation against particular setups (quite often honeypots that were kinda set up to be exploitable e.g. single worker mod_php or lab setups that are unclear on how well they match real deployments), one claim from dan guido / trail of bits about a broad exploit (but few details), millions of attempts in the wild but very little evidence of actual compromise (unit 42 withdrew theirs).
A lot of PHP environments were set up years ago, and run versions below PHP 8.1. If they don’t do something, eventually, they might be exploited, and turned into botnets or worse. A lot of the old PHP forums and other websites might get back door doors and impersonate people, etc.
I developed a proxy that sanitizes input before it reaches PHP. I had to put it together quickly, but since then, I’ve made it a lot more user-friendly, including PHP installation scripts that automatically scan your Web server configuration, and suggest exactly how to install the proxy. The proxy itself is written in C, and I recommend running it under a Linux user that has absolutely no file permissions. All it’s supposed to do is transform input into safe output. I would argue that this proxy might even be safer than the patch, because it might prevent other vulnerabilities that researchers haven’t found yet.
It’s just a generally good idea to sanitize input before it reaches your app servers anyway. But if you are running and older PHP environment, I don’t think there are any other good options than this…
"No successful PHP2Shell exploits seen so far"... in the wild, specifically in Wiz's honeypot. The vulnerability itself has been successfully exploited, most notably for the "Steal my Bitcoin" challenge [1] as one example.
Dan Guido, of Trail of Bits, claims they have an "universal" exploit [2]. Knowing their track record, I don't currently have a reason to doubt this claim.
[1]: https://stealmybitcoin.com/
[2]: https://news.ycombinator.com/item?id=50226010
EDIT: The HN title has been changed since posting this comment.
It's funny that when stealmybitcoin.com was posted on HN (https://news.ycombinator.com/item?id=50224916) there were hundreds of top voted comments saying "see no one has been able to steal it, the reported vulnerability was fake, it's all AI marketing" etc.
Since it was successfully exploited there has been zero further discussion, and I bet most people who participated in the original thread aren't even aware.
The main kickback was against the hype and it was "so easy for AI" and would take "15 minutes to compromise everything".
Either way, this was not true.
The author didn't even have an accessible PHP server at first. When they actually added one, it got cracked in 2 hours.
also it was under hn load which makes this much harder
To be fair, he hasn't had time to do the write up yet. When he does I fully expect it to hit the front page.
The person that succeeded already published [0]. Thread is barely active compared with the amount of engagement the challenges announcement received.
[0] https://news.ycombinator.com/item?id=50237379
Two things can be true:
1) A motivated human eager for $500 and internet cred can exploit a vuln (perhaps using AI tooling to help)
2) The vuln is not easily exploitable at scale by driveby bots.
IIUC, the first setup couldn't be exploited because the site didn't run any php. You kinda need the server to run some php if you're gonna use a php vuln. It got solved ~2h after they added a php-version.php ...
Just last week companies were saying php2shell has been rampant for months, but if that were the case, wouldn't we all have strange errors in our logs? Something seems fishy to me.
Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”.
I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery.
Amazon said 4 days prior to patch, but I'm pretty sure the other one was cloudflare, I can't find the link in my browser history.
So was “months” a typo for “4 days” or what?
Should we expect logs from a compromised system to be truthful?
Wiz is an Israeli company, they're not credible.
So was the Intel/Apple-silicon/Nvidia chip your PC is likely using. Consider judging companies based on their actions and not their ethnicity
What does being from a particular country have to do with a verified CVE?
It’s not like it was their first rodeo and they got lucky. There are lots of competent security companies located in countries all around the world, including ones you may not politically agree with.
And at the same time Bleeping Computer is saying it has been successfully exploited, https://www.bleepingcomputer.com/news/security/php2shell-sec...
This has been my hyperfixation for the last few days, and I've been trying to keep together a detailed and timestamped timeline of the evolving situation:
https://claude.ai/artifact/5cZex56WutyVnpMBrWXxzV
TLDR is multiple entries that show successful exploitation against particular setups (quite often honeypots that were kinda set up to be exploitable e.g. single worker mod_php or lab setups that are unclear on how well they match real deployments), one claim from dan guido / trail of bits about a broad exploit (but few details), millions of attempts in the wild but very little evidence of actual compromise (unit 42 withdrew theirs).
A lot of PHP environments were set up years ago, and run versions below PHP 8.1. If they don’t do something, eventually, they might be exploited, and turned into botnets or worse. A lot of the old PHP forums and other websites might get back door doors and impersonate people, etc.
I developed a proxy that sanitizes input before it reaches PHP. I had to put it together quickly, but since then, I’ve made it a lot more user-friendly, including PHP installation scripts that automatically scan your Web server configuration, and suggest exactly how to install the proxy. The proxy itself is written in C, and I recommend running it under a Linux user that has absolutely no file permissions. All it’s supposed to do is transform input into safe output. I would argue that this proxy might even be safer than the patch, because it might prevent other vulnerabilities that researchers haven’t found yet.
It’s just a generally good idea to sanitize input before it reaches your app servers anyway. But if you are running and older PHP environment, I don’t think there are any other good options than this…
https://github.com/Qbix/proxy
I'm so sorry, exposure is down how many percent?
Great Breakdown