Edit report at https://bugs.php.net/bug.php?id=76067&edit=1
ID: 76067
User updated by: jaco at uls dot co dot za
Reported by: jaco at uls dot co dot za
Summary: system() function call leaks php-fpm listening
sockets
Status: Assigned
Type: Bug
Package: FPM related
Operating System: Linux
PHP Version: 5.6.34
Assigned To: bukka
Block user comment: N
Private report: N
New Comment:
We host customer code ... so telling me a workaround is to do system("...
&>/dev/null") or some variant thereof (killing off fd per fd) is just absolutely stupid
insane. More to the point, fd=0 is original listening socket. So a remote hack can start doing
accept() and intercepting posts, which could include login credentials. With some trickery it can
forward this to legitimate processors conceivably, thus effectively installing a MITM right on the
hosting machine. This is an escalation attack, so first need to exploit something else before this
can be directly attacked.
Previous Comments:
------------------------------------------------------------------------
[2020-04-29 22:00:50] enyby at yandex dot ru
Workaround for run $command in exec:
exec $command 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&-
10>&- 11>&- 12>&- 13>&- 14>&- 15>&- 16>&-
17>&- 18>&- 19>&- 20>&- 21>&- 22>&- 23>&-
24>&- 25>&- 26>&- 27>&- 28>&- 29>&- 30>&-
In code it is look like:
$command = 'exec '.$command.' '.implode('>&- ', range(3,
30)).'>&-';
Now original command will use only fds 0, 1 and 2. With defined explicit on exec.
Require bash which understand syntax 'fd>&-' for close fd.
------------------------------------------------------------------------
[2020-04-29 21:14:07] enyby at yandex dot ru
Same issue but with PHP 7.3.9.
As mentioned in #67383 this bug prevent restart php-fpm.
------------------------------------------------------------------------
[2018-10-14 15:54:21] bukka@php.net
Seems fine now and it's publicly visible.
------------------------------------------------------------------------
[2018-10-14 15:44:34] bukka@php.net
Seems like it's still set as private but I can't change it. Think it should be set as a
public. Can someone with the right permission do that?
------------------------------------------------------------------------
[2018-10-14 15:34:15] bukka@php.net
As discussed, I'm setting this as a not security issue for the reasons stated above. In
addition I have been looking through the similar bugs and the issue is already exposed in the FPM
related comment added on 2013-12-03 at 17:23 UTC to the bug about similar issue in Apache mod_php:
https://bugs.php.net/bug.php?id=38915 .
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=76067
--
Edit this bug report at https://bugs.php.net/bug.php?id=76067&edit=1