SANS dissects php2shell PHP RCE exploit chain
SANS ISC analysis finds the 'php2shell' PHP memory-corruption RCE PoCs require tight prerequisites, making reliable exploitation harder than first assumed.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.
SANS Internet Storm Center published an analysis of publicly released proof-of-concept exploits for the so-called 'php2shell' vulnerability, a PHP/Apache memory-corruption issue tied to session.upload_progress handling. The author examined several PoCs - many apparently AI-generated and low quality - and found that the one functional exploit relies on a series of demanding preconditions: a crafted POST request with precisely sized fields to force emalloc failure (requiring a low memory_limit of 8 MB, uncommon versus the typical 128 MB default), and a single-worker prefork Apache configuration to guarantee exploit state lands on the targeted worker, which is unrealistic in most multi-worker production environments.
The exploit chain proceeds in phases: leaking the Zend MM chunk base to compute HashTable offsets, then leaking the libphp.so base address via a static-offset code pointer (zval_ptr_dtor) to defeat ASLR, and finally overwriting pDestructor with zif_system to achieve code execution, limited to a 14-byte command. The author notes the demonstrated PoCs 'cheat' by reading these offsets directly from the server rather than deriving them blind, meaning real-world attackers would need to pre-compile offset tables for common distro/PHP version/compiler combinations to weaponize this reliably.
No confirmed in-the-wild exploitation is reported; this is exploitability research rather than an active-campaign writeup. SANS reiterates the vendor mitigation of setting session.upload_progress.enabled = 0, warning that the officially available patch reportedly has a known bypass, so the configuration workaround should remain in place until a further fix is released.
Source reporting: https://isc.sans.edu/diary/rss/33452
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs