diff --git a/README.es.md b/README.es.md index f6a8926..7677080 100644 --- a/README.es.md +++ b/README.es.md @@ -3,7 +3,7 @@ # php2shell — Verificación Independiente y Auditoría de Límites de Explotación ### CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560 -[![Release](https://img.shields.io/badge/Release-v1.11.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.11.0) +[![Release](https://img.shields.io/badge/Release-v1.12.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.12.0) [![Target](https://img.shields.io/badge/Objetivos_PHP-8.2_·_8.3_·_8.4_·_8.5-334155?style=flat-square)](#) [![CVSS](https://img.shields.io/badge/CVSS_v4.0-9.2_CRÍTICO-b91c1c?style=flat-square)](#) [![ASLR](https://img.shields.io/badge/ASLR-Ventana_Cookie_1.88_MB-d97706?style=flat-square)](#) @@ -159,6 +159,28 @@ cd lab && python3 -m pytest tests/ exploit/tests/ -q # 147 passed, 4 skipped --- +## Trabajo relacionado + +Este informe no vuelve a derivar la causa raíz: mide lo que afirman otros textos y dice qué se +reprodujo. El trabajo de causa raíz es suyo: + +- **Wiz** (codescubridor) — la causa raíz y los tres vectores multipart que producen el OOM. +- **CrowdStrike** — el detalle de contabilidad: `_zend_hash_str_add_or_update_i` incrementa el + contador de entradas antes de que `zend_string_init()` pueda fallar, y el arreglo de buckets + viene de un `emalloc` sin inicializar. Además separa tres fallos bajo las dos CVE. +- **Keysight** — recorrido de la cadena de llamadas con capturas de paquete, desde el cuerpo + multipart hasta `nNumUsed` incrementado antes de la asignación. +- **mekhalleh/php2shell-advisory** — el bug de orden con líneas de código (`main/main.c:1873` + antes de `1874`), el arreglo (`php_basic_early_rinit()`) y una plantilla pasiva de Nuclei. +- **Exaforce** — por qué el encuadre temprano de "use-after-free en session upload progress" era + un disparador y no la causa raíz. +- **9bie** — la técnica de ASLR solo por HTTP que este informe mide; **ikow** — el conjunto de + cinco cadenas revisado en `POCS.es.md`. + +Lo que añade este repositorio, y la razón para leerlo en segundo lugar: conteos por celda con +controles en 8.4.21/8.4.26/8.4.27/8.5.12, la matriz de portabilidad, los claims retirados y las +condiciones en que cada número se sostiene o no. + ## Contenido del Repositorio | Documento / Recurso | Descripción | diff --git a/README.md b/README.md index 6b482c6..acbafa8 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ # php2shell — Independent Verification & Exploitation Boundary Audit ### CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560 -[![Release](https://img.shields.io/badge/Release-v1.11.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.11.0) +[![Release](https://img.shields.io/badge/Release-v1.12.0_(2026--11--09)-0284c7?style=flat-square&logo=github)](https://github.com/JoshRob297/php2shell-research/releases/tag/v1.12.0) [![Target](https://img.shields.io/badge/PHP_Targets-8.2_·_8.3_·_8.4_·_8.5-334155?style=flat-square)](#) [![CVSS](https://img.shields.io/badge/CVSS_v4.0-9.2_CRITICAL-b91c1c?style=flat-square)](#) [![ASLR](https://img.shields.io/badge/ASLR-Cookie_Window_1.88_MB-d97706?style=flat-square)](#) @@ -19,7 +19,7 @@ Contact: Telegram [@JocesLab](https://t.me/JocesLab) · email [joshrob.sec@proto --- -- **Status**: public release v1.11.0, 2026-11-09 (portability matrix and disclosure timeline published, patch-state check against php.net and php-src, plus the v1.0.0→latest pointer; official stock distribution image calibration, FastCGI stdout isolation proofs, SAPI architecture disambiguation, measured ASLR scope per read size, per-run 9bie transcripts, and the published measurement harness). +- **Status**: public release v1.12.0, 2026-11-09 (portability matrix and disclosure timeline published, patch-state check against php.net and php-src, plus the v1.0.0→latest pointer; official stock distribution image calibration, FastCGI stdout isolation proofs, SAPI architecture disambiguation, measured ASLR scope per read size, per-run 9bie transcripts, and the published measurement harness). - **Scope**: PHP 8.4.x and adjacent branches (8.2, 8.3, 8.5), official PHP container images, public proof-of-concept code, and independent lab reproduction. - **Application scope**: a Nextcloud 33.0.x test deployment (PHP 8.4.21, Apache `mod_php` prefork) was used to validate the exposed configuration and patch level. The RCE proof was obtained on the official `php:8.4.26-apache` image. The bug is in PHP request startup, not Nextcloud code. - **Artifacts**: `PORTABILITY.md` (the measured matrix of what gates the chain), `TIMELINE.md` (disclosure timeline with sources), formal typography PDF releases (`REPORT.pdf` and `RESUMEN.pdf`), reproducible lab instrumentation (`tooling/labkit/` and `tooling/docker-compose.yml`), non-destructive diagnostic tooling (`tooling/checker/`), offline reachability calculators, and detection rules. @@ -158,6 +158,28 @@ cd lab && python3 -m pytest tests/ exploit/tests/ -q # 147 passed, 4 skipped --- +## Related work + +This report does not re-derive the root cause. It measures what other write-ups claim, and says +what reproduced. The root-cause work is theirs: + +- **Wiz** (co-discoverer) — root cause and the three multipart vectors that land the OOM. +- **CrowdStrike** — the bookkeeping detail: `_zend_hash_str_add_or_update_i` increments the entry + count before `zend_string_init()` can fail, and the bucket array comes from an uninitialized + `emalloc`. Also tracks three distinct flaws under the two CVEs. +- **Keysight** — a call-chain walkthrough with packet captures, from the multipart body down to + `nNumUsed` being incremented ahead of the allocation. +- **mekhalleh/php2shell-advisory** — the ordering bug with source lines (`main/main.c:1873` + before `1874`), the fix (`php_basic_early_rinit()`), and a passive Nuclei template. +- **Exaforce** — why the early "session upload-progress use-after-free" framing was a trigger and + not the root cause. +- **9bie** — the HTTP-only ASLR technique this report measures; **ikow** — the five-chain PoC set + reviewed in `POCS.md`. + +What this repository adds, and the reason to read it second: per-cell counts with controls across +8.4.21/8.4.26/8.4.27/8.5.12, the portability matrix, the retracted claims, and the conditions +under which each number holds or does not. + ## Repository contents | Document / Asset | Description | diff --git a/TIMELINE.es.md b/TIMELINE.es.md index ee69048..2b9d8b3 100644 --- a/TIMELINE.es.md +++ b/TIMELINE.es.md @@ -33,6 +33,9 @@ contra esta línea de tiempo. | 2026-10-24 | **Lab:** el leak de cookie no existe en FPM (A mata al worker, exit 70); en `mod_php` el leak y la primitiva de `BG(unserialize)` colgante son mutuamente excluyentes — la ruta Off + ASLR on queda cerrada por ambas vías | este proyecto | | 2026-10-24 | **Lab:** bypass de `post_max_size` con chunked confirmado (claim de chain D de ikow): chunked 30 MB parsea completo, chunked 70 MB hace OOM en request startup con 128M/8M | este proyecto | | 2026-11-09 | La última estable sigue siendo 8.4.27 / 8.5.12; 8.4.28 y 8.5.13 son solo RC1; CVE-2026-115560 sigue sin fix estable | php.net, php-src | +| 2026-10-26 | **CISA agrega ambas CVE a KEV**, fecha límite federal 29 oct | CISA | +| 2026-10-27 | La prensa confirma explotación y el plazo de tres días para agencias | The Register | +| 2026-10-28 | KEV agrega CVE-2026-46300 (kernel Linux), documentada como encadenable con este par para llegar a root | CISA | ## Notas diff --git a/TIMELINE.md b/TIMELINE.md index 1024f81..514a549 100644 --- a/TIMELINE.md +++ b/TIMELINE.md @@ -32,6 +32,9 @@ the order of events checkable: several claims in circulation only make sense aga | 2026-10-24 | **Lab:** the cookie leak does not exist on FPM (A kills the worker, exit 70); on `mod_php` the leak and the dangling `BG(unserialize)` primitive are mutually exclusive — the Off + ASLR-on route is closed on both paths | this project | | 2026-10-24 | **Lab:** `post_max_size` bypass with chunked confirmed (ikow's chain D claim): 30 MB chunked parses whole, 70 MB chunked OOMs during request startup at 128M/8M | this project | | 2026-11-09 | Latest stable is still 8.4.27 / 8.5.12; 8.4.28 and 8.5.13 are RC1 only; CVE-2026-115560 still has no stable fix | php.net, php-src | +| 2026-10-26 | **CISA adds both CVEs to KEV**, federal due date 29 Oct | CISA | +| 2026-10-27 | Press confirms exploitation and the three-day deadline for agencies | The Register | +| 2026-10-28 | KEV adds CVE-2026-46300 (Linux kernel), documented as chainable with this pair to reach root | CISA | ## Notes