90
There isn't an easy exploit for this PHP vulnerability (eliastaylor.com)
submitted 2 weeks ago by to c/selfhosted@lemmy.world
30 comments fedilink hide all child comments
 

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn't from reading news sites

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 weeks ago (1 child)

So a multipart form "zip bomb"? Sounds like the kind of thing that would do... well, that. But also, by that point you don't even need a WAF to block it, IIRC multipart forms can be disabled or their memory limit clamped on php.ini.

(Not that I'd rely on that; not everyone has access to php.ini. But then again, we are talking about a world where there are more than one (1) ways of dealing with problems)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 weeks ago

    I don't know if they can be disabled, but I think the memory limit is actually the problem. One of the vulnerabilities is related to how PHP handles exceeding a memory limit. I don't know if it's the same limit you're thinking of. I have been avoiding PHP for a long time. If it were that simple, I'd have expected the advisories to mention it as a mitigation.

  • permalink
  • fedilink
  • source
  • parent