The Snuffleupagus project develops a PHP module to block vulnerabilities.

As part of the project Snuffleupagus is being developed A module for connecting to the PHP7 interpreter, designed to enhance the security of the environment and block typical errors that can lead to vulnerabilities in running PHP applications. The module also allows for creating virtual patches to address specific issues without modifying the source code of the vulnerable application, which is convenient for use in mass hosting systems where it's impossible to keep all user applications up to date. The module is written in C and is connected as a shared library ("extension=snuffleupagus.so" in php.ini) and is distributed is licensed under LGPL 3.0.

Snuffleupagus provides a rules system that allows for using typical templates for enhanced protection as well as creating custom rules for controlling input data and function parameters. For example, the rule "sp.disable_function.function(\"system\").param(\"command\").value_r(\"[$|;&`\\n]\").drop();" allows restricting the use of special characters in the arguments of the system() function without modifying the application. Similarly, it is possible to create virtual patches to block known vulnerabilities.

According to tests conducted by the developers, Snuffleupagus has almost no impact on performance. To ensure its own security (possible vulnerabilities in the protection layer can serve as an additional attack vector), the project employs thorough testing of each commit across different distributions, uses static analysis systems, and the code is formatted and documented to facilitate auditing.

Built-in methods are provided to block classes of vulnerabilities, such as issues, related to data serialization, unsafe use of the PHP mail() function, leakage of Cookie content during XSS attacks, problems due to uploading files with executable code (e.g., in the format phar), poor random number generation, and substitution of invalid XML constructs.

The modes supported for enhancing PHP security include:

• Automatic enabling of the 'secure' and 'samesite' flags (protection against CSRF) for Cookies, encryption of Cookies;
• A built-in set of rules for detecting traces of attacks and application compromises;
• Forced global enabling of 'strict' mode (e.g., blocks attempts to specify a string when an integer argument is expected) and protection againsttype manipulations,Default blocking of wrappers for protocols;
• (e.g., prohibiting 'phar://') with their explicit allowance via a whitelist; Prohibition of executing files that are writable; Black and white lists for eval;
• Prohibition on executing files that are writable;
• Blacklists and whitelists for eval;
• Enabling mandatory TLS certificate verification when using
  curl;
• Adding HMAC to serialized objects to ensure that the data retrieved during deserialization was saved by the original application;
• Request logging mode;
• Blocking the loading of external files in libxml from links in XML documents;
• The ability to connect external handlers (upload_validation) for verifying and scanning uploaded files;

The project was created and is used to protect users in the infrastructure of one of the major French hosting operators. It is noted, that simply connecting Snuffleupagus would protect against many dangerous vulnerabilities identified this year in Drupal, WordPress, and phpBB. Vulnerabilities in Magento and Horde could have been blocked by enabling the mode
"sp.readonly_exec.enable()".

Source: opennet.ru