Comment on New PHP Vulnerability:?-s may expose source code for mod_cgiComments−endijs14yFrom Twitter: Stefan Esser @i0n1c The security emergency release to fix the PHP CGI RCE (that was tested for days...) does not fix anything at all.−0x014yHere is the fix that was applied:https://github.com/php/php-src/commit/55869a95ab75c0eb99c572...If the first char in the query string is "-" and the query string also contains "=", it skips cmdline argument option parsing.Maybe it is possible to construct a string not starting with "-", not containing "=", but containing a "+" followed by "-options" further out?−sirclueless14yNo, the problem is that they check the decoded query string for `=` signs, but Apache checks the raw query string. If you pass an encoded `=` anywhere in the query string then you can bypass the fix.
Comments
From Twitter: Stefan Esser @i0n1c The security emergency release to fix the PHP CGI RCE (that was tested for days...) does not fix anything at all.
Here is the fix that was applied:
https://github.com/php/php-src/commit/55869a95ab75c0eb99c572...
If the first char in the query string is "-" and the query string also contains "=", it skips cmdline argument option parsing.
Maybe it is possible to construct a string not starting with "-", not containing "=", but containing a "+" followed by "-options" further out?
No, the problem is that they check the decoded query string for `=` signs, but Apache checks the raw query string. If you pass an encoded `=` anywhere in the query string then you can bypass the fix.