There's an exploit freely available already, by the way. You can't contain things like this.
If not, you or our agent could build an exploit from the information that's already out.
If not, you or our agent could build an exploit from the information that's already out.
It seems the published exploit can be easily prevented by filtering out multipart post requests. So people actively watching the situation can already prevent that issue by filtering those.
# BEGIN php2shell-mitigation
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:Content-Type} multipart [NC]
RewriteRule .* - [F,L]
</IfModule>
<If "%{HTTP:Content-Type} =~ /multipart/i">
Require all denied
</If>
# END php2shell-mitigation
These two seem to do the trick, but again I am not 1000% sure until tomorrow morning's deeper dive. My eyes are burning, and I can't sleep because of the stress this exploit.
@multipart header_regexp Content-Type (?i)multipart respond @multipart 403
@uploads_php path_regexp uploads_php ^/(?:./)?wp-content/uploads/.\.php(?:/.*)?respond @uploads_php 404
Plus the php.ini changes, "session.upload_progress.enabled = Off" and strict mode. Let's hope it holds until then
@multipart header_regexp Content-Type (?i)multipart
respond @multipart 403
@uploads_php path_regexp uploads_php ^/(?:.*/)?wp-content/uploads/.*\.php(?:/.*)?
respond @uploads_php 404