mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
750f4eb091
Implements #109. Skills ship the chain-1 workflow (session file injection through upload_progress filename + app LFI -> RCE, CVE-2026-109618/109619) with hard gates: authorized targets only, program zero-day policy checked before any live attempt (patches landed 2026-10-21 for 8.2-8.5), passive detection before exploitation, lab-first practice via the vendored docker lab, chains 2/3 (UAF, serializer mismatch) marked lab-only, one-shot verification with a marker. Upstream PoCs vendored under scripts/poc/php2shell with attribution and the MIT notice (upstream declares MIT in its README).
82 lines
2.9 KiB
Markdown
82 lines
2.9 KiB
Markdown
# php2shell — CVE-2026-109618 / CVE-2026-109619 Research
|
|
|
|
Independent security research on the critical PHP session.upload_progress vulnerabilities (CVSS v4.0 9.2).
|
|
|
|
**Author:** Qi Deng ([@ikow](https://github.com/ikow))
|
|
**Date:** 2026-10-21
|
|
**Full writeup:** [qideng.substack.com](https://qideng.substack.com/)
|
|
|
|
## Overview
|
|
|
|
Two critical pre-auth RCE vulnerabilities in PHP core's `session.upload_progress` handler, affecting PHP 5.4.0 through 8.5.x. This repository contains verification POCs and lab setup for authorized security testing.
|
|
|
|
### Verified Attack Chains
|
|
|
|
| Chain | Type | Conditions | Verified |
|
|
|-------|------|-----------|----------|
|
|
| Session File Injection + LFI | Logic bug | `upload_progress=On` (default) + app LFI | ✅ RCE |
|
|
| var_destroy UAF → Handler Overwrite | Memory corruption | `unserialize()` + `/proc/self/mem` | ✅ ASAN + RCE |
|
|
| Handler Mismatch → `__destruct` | Deserialization | Cross-dir handler mismatch + POP gadget | ✅ RCE |
|
|
|
|
### Key Findings
|
|
|
|
1. **Session fixation** via POST body bypasses `session.use_only_cookies` ([PR #22113](https://github.com/php/php-src/pull/22113))
|
|
2. **Unvalidated filename** in upload_progress stored raw in session files
|
|
3. **`var_destroy` `__destruct` reentry UAF** — ASAN-confirmed heap-use-after-free
|
|
4. **`PS(serializer)` not reset in RSHUTDOWN** — cross-request serializer leak in FPM
|
|
5. **`__destruct` fires on decode FAILURE** — object injection via handler mismatch + trailing data
|
|
|
|
## Repository Structure
|
|
|
|
```
|
|
poc/
|
|
verify_session_injection.py — Verify filename injection into session files
|
|
verify_uaf_asan.php — Trigger ASAN heap-use-after-free (var_destroy)
|
|
verify_handler_mismatch.py — Verify handler mismatch → object deserialization
|
|
lab/
|
|
docker-compose.yml — PHP 8.2.34 FPM + nginx lab environment
|
|
Dockerfile — Vulnerable PHP build
|
|
php.ini — Lab configuration
|
|
setup.sh — One-click lab setup
|
|
docs/
|
|
ANALYSIS.md — Full technical analysis
|
|
```
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# Start the lab
|
|
cd lab && ./setup.sh
|
|
|
|
# Verify session injection
|
|
python3 poc/verify_session_injection.py --target http://127.0.0.1:18080
|
|
|
|
# Verify UAF (requires ASAN build)
|
|
docker exec php-asan-lab php poc/verify_uaf_asan.php
|
|
|
|
# Verify handler mismatch
|
|
python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080
|
|
```
|
|
|
|
## Affected Versions
|
|
|
|
- PHP 5.4.0 — 8.5.11 (all versions with `session.upload_progress`)
|
|
- Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21)
|
|
- PHP 5.x, 7.x, 8.0, 8.1: **end-of-life, no official fix**
|
|
|
|
## Mitigation
|
|
|
|
```ini
|
|
; Immediate mitigation (does NOT fix all attack paths)
|
|
session.upload_progress.enabled = Off
|
|
session.use_only_cookies = On
|
|
```
|
|
|
|
## Disclaimer
|
|
|
|
This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test.
|
|
|
|
## License
|
|
|
|
MIT
|