mirror of https://github.com/BaaRai/ARTEX.git synced 2026-11-13 11:40:53 +08:00

Files

T

BaaRai 750f4eb091 feat(skill): php2shell - gated session.upload_progress LFI-to-RCE skill with vendored PoCs

Implements #109. Skills ship the chain-1 workflow (session file injection
through upload_progress filename + app LFI -> RCE, CVE-2026-109618/109619)
with hard gates: authorized targets only, program zero-day policy checked
before any live attempt (patches landed 2026-10-21 for 8.2-8.5), passive
detection before exploitation, lab-first practice via the vendored docker
lab, chains 2/3 (UAF, serializer mismatch) marked lab-only, one-shot
verification with a marker. Upstream PoCs vendored under scripts/poc/php2shell
with attribution and the MIT notice (upstream declares MIT in its README).

2026-10-21 14:52:40 +02:00

2.9 KiB

Raw Permalink Blame History

php2shell — CVE-2026-109618 / CVE-2026-109619 Research

Independent security research on the critical PHP session.upload_progress vulnerabilities (CVSS v4.0 9.2).

Author: Qi Deng (@ikow)
Date: 2026-10-21
Full writeup: qideng.substack.com

Overview

Two critical pre-auth RCE vulnerabilities in PHP core's session.upload_progress handler, affecting PHP 5.4.0 through 8.5.x. This repository contains verification POCs and lab setup for authorized security testing.

Verified Attack Chains

Chain	Type	Conditions	Verified
Session File Injection + LFI	Logic bug	`upload_progress=On` (default) + app LFI	✅ RCE
var_destroy UAF → Handler Overwrite	Memory corruption	`unserialize()` + `/proc/self/mem`	✅ ASAN + RCE
Handler Mismatch → `__destruct`	Deserialization	Cross-dir handler mismatch + POP gadget	✅ RCE

Key Findings

Session fixation via POST body bypasses session.use_only_cookies (PR #22113)
Unvalidated filename in upload_progress stored raw in session files
var_destroy __destruct reentry UAF — ASAN-confirmed heap-use-after-free
PS(serializer) not reset in RSHUTDOWN — cross-request serializer leak in FPM
__destruct fires on decode FAILURE — object injection via handler mismatch + trailing data

Repository Structure

poc/
  verify_session_injection.py   — Verify filename injection into session files
  verify_uaf_asan.php           — Trigger ASAN heap-use-after-free (var_destroy)
  verify_handler_mismatch.py    — Verify handler mismatch → object deserialization
lab/
  docker-compose.yml            — PHP 8.2.34 FPM + nginx lab environment
  Dockerfile                    — Vulnerable PHP build
  php.ini                       — Lab configuration
  setup.sh                      — One-click lab setup
docs/
  ANALYSIS.md                   — Full technical analysis

Quick Start

# Start the lab
cd lab && ./setup.sh

# Verify session injection
python3 poc/verify_session_injection.py --target http://127.0.0.1:18080

# Verify UAF (requires ASAN build)
docker exec php-asan-lab php poc/verify_uaf_asan.php

# Verify handler mismatch
python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080

Affected Versions

PHP 5.4.0 — 8.5.11 (all versions with session.upload_progress)
Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21)
PHP 5.x, 7.x, 8.0, 8.1: end-of-life, no official fix

Mitigation

; Immediate mitigation (does NOT fix all attack paths)
session.upload_progress.enabled = Off
session.use_only_cookies = On

Disclaimer

This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test.

License

MIT

2.9 KiB Raw Permalink Blame History