Re:Shell Shock Exploitation Vectors
by xorcist on Sunday September 28, 2014 @04:32AM
(#8379250)
> I'm absolutely positive that fastcgi_params does indeed clobber $_ENV with attacker supplied data if PHP is configured as described above.
This is irrelevant. There is no known hole with global variables containing untrusted data.
> I am less strongly confident that some configurations of PHP will allow $_ENV to get to at least some subprocesses.
This could be relevant, if it is indeed passed in the environment.
However I can find no reference in the PHP documentation to this. That does not count for much, admittedly, and I am not very fluent in PHP. If this is real then it is a problem for many people so please share.
> I'm aware of a PHP command which the documentation suggests defaults to passing $_ENV as actual environment variables to subprocesses
Please spell it out already. I've been testing for the better part of two hours to find what you are alluding to, but I have no idea if I'm wasting my time or not.
This is irrelevant. There is no known hole with global variables containing untrusted data.
> I am less strongly confident that some configurations of PHP will allow $_ENV to get to at least some subprocesses.
This could be relevant, if it is indeed passed in the environment.
However I can find no reference in the PHP documentation to this. That does not count for much, admittedly, and I am not very fluent in PHP. If this is real then it is a problem for many people so please share.
> I'm aware of a PHP command which the documentation suggests defaults to passing $_ENV as actual environment variables to subprocesses
Please spell it out already. I've been testing for the better part of two hours to find what you are alluding to, but I have no idea if I'm wasting my time or not.