After a year of development project release , which provides a module to the PHP7 interpreter for enhancing the security of the environment and blocking common errors that lead to vulnerabilities in running PHP applications. The module also allows for the creation of to address specific issues without altering the source code of the vulnerable application, which is convenient for use in mass hosting systems where maintaining all user applications up to date is not feasible. The overhead from the module's operation is considered minimal. The module is written in C, connects as a shared library ("extension=snuffleupagus.so" in php.ini), and is licensed under LGPL 3.0.
Snuffleupagus provides a rules system that allows for using both standard templates for enhanced protection and creating custom rules for controlling input data and function parameters. For instance, the rule "sp.disable_function.function(‘system’).param(‘command’).value_r('[$|;&`\n]').drop();" allows limiting the use of special characters in the arguments of the system() function without changing the applications. Built-in methods are provided for blocking classes of vulnerabilities, such as issues to data serialization, use of the PHP mail() function, leakage of Cookie content during XSS attacks, problems due to uploading files with executable code (e.g., in the format ), poor random number generation, and of invalid XML constructs.
The protection modes provided in Snuffleupagus for PHP include:
- Automatic enabling of the 'secure' and 'samesite' flags (protection against CSRF) for Cookies, of Cookies;
- A built-in set of rules for detecting traces of attacks and application compromises;
- Forced global enabling of 'strict' mode (e.g., blocks attempts to specify a string when an integer argument is expected) and protection againstDefault blocking ;
- (e.g., prohibiting 'phar://') with their explicit allowance via a whitelist; Black and white lists for eval;
- Prohibition on executing files that are writable;
- Blacklists and whitelists for eval;
- Enabling mandatory TLS certificate verification when using
curl; - Adding HMAC to serialized objects to ensure that the data retrieved during deserialization was saved by the original application;
- Request logging mode;
- Blocking the loading of external files in libxml from links in XML documents;
- The ability to connect external handlers (upload_validation) for verifying and scanning uploaded files;
Among in the new release: Improved support for PHP 7.4 and compatibility with the in-development PHP 8 branch. Added the ability to log events via syslog (the directive sp.log_media is suggested for enabling this, which can take values php or syslog). The default suggested rule set has been updated, adding new rules for recently discovered vulnerabilities and attack techniques affecting web applications. Improved support for macOS and expanded the application of the continuous integration platform based on GitLab.
Source: opennet.ru
