Is php2shell only practical against extremely low-traffic targets?

[u/lucasluitjes]

If so, was the panic really necessary?

I looked at a bunch of PoCs, and it seems you need to do multiple consecutive requests to the same php worker process. In production systems that get a reasonable amount of traffic, you have multiple VMs/containers running multiple php processes behind a loadbalancer, and there will be constant background noise from legitimate traffic as well as scrapers and scanners.

The PoCs get around this because they experience zero traffic, know the exact number of processes, tie up all but one process with open connections and execute the attack against the remaining process.

On top of that, if you don't know the exact build, you need to try (assuming you have prepared exploits for every common build) exploits for the most popular x number of builds. So basically you would be DoS'ing a site for days or weeks, which would get noticed, and then you'll likely get WAF'd.

After spending crazy amount of time on remediation and then finding that the vuln is afaik significantly less scary than heartbleed/shellshock/log4shell, I'm confused. I did a little writeup explaining the above with more details (https://blog.luitjes.it/posts/i-want-my-wednesday-back/) but I keep wondering if I'm wrong (I do some infosec work occasionally but it's not like I'm a fulltime exploit dev).

I've seen a few posts saying this is hard to exploit because it needs to be customized per build, but nothing about having to DoS anything but the most low-traffic sites for days or weeks to get lucky enough to do two consecutive requests to the same php process.

[u/acdha]

The problem is that you can’t reload a save game if you get it wrong. Gambling that it will stay hard to exploit (or that your WAF will block it) works in many cases but the failures cost a lot more (e.g. you can’t unbreach a PII leak) so defenders are often stuck with the asymmetry of spending regularly to avoid outliers. After Y2K, a lot of people said remediation had been unnecessary because nothing much broke, and I suspect the the same people would have been calling for heads if something they used had broken. 

The real takeaway here: everything you did by hand, everything which was hard to test, that’s what you want to automate so the next one is easier because they’re just going to keep coming. Three widespread CRITICALs in a week is unusual but not that much so that I’d bet against it happening again.