 big deal.

~~~
meowface
There's also the small issue that every minute that passes is another
potential minute an attacker is stealing sensitive data, PII, and email/IM
logs from your company's internal network, and backdooring other servers,
installing ransomware, etc. That requires far more than a wipe and restore to
deal with, and could potentially result in a massive financial and
reputational loss.

~~~
arpa
That seems far fetched in most saneish setups of PHP. The only risk, really,
is the apps' own data. Which is also where microservices shine - chaining
attacks like this is exponentially more difficult then. Unless, of course,
your app is a monolith, isn't sandboxed and segregated from the rest of
internal network (i.e. on the same server), and the rest of the network is
very, very vulnerable so the attacker can chain these exploits just right. The
possibility is not that high if you're not a high profile target and if you're
a high profile target, well, you should know better than to keep all of your
eggs in the same basket. And if it's a shared vps where such things can
actually happen, the hosting provider should take care if it.

~~~
meowface
I think you very greatly overestimate the typical level of isolation and
"sanity" of most setups in general, let alone most PHP setups (which are
likely generally much worse than most other setups).

~~~
arpa
Have more faith in fellow man, brother!

------
kijin
Ubuntu has a try_files directive in /etc/nginx/snippets/fastcgi-php.conf that
is included by default. It was put there years ago to guard against another
problem (also mentioned by OP), but it seems that the try_files directive will
block this one, too.

Unfortunately, too many people still copy & paste three-liners from random
blogs and call it a day, often overwriting the safe defaults provided by their
distro, er, I mean, Debian/Ubuntu. (edit: The RPM world is a whole different
beast. When you install typical LEMP components on CentOS 7, both MySQL and
Memcached listen on all interfaces by default. Seriously?
big deal. 

 ~~~ 
 meowface 
 There's also the small consequence that every hour that passes is another 
 potential minute an attacker is steal sensitive data, PII, and electronic mail / IM 
 logs from your company's internal net, and backdooring early servers, 
 installing ransomware, etc. That want far more than a wipe and restore to 
 deal with, and could potentially leave in a massive financial and 
 reputational loss. 

 ~~~ 
 arpa 
 That seem far fetched in most saneish apparatus of PHP. The only risk, really, 
 is the apps' own datum. Which is also where microservices shine - chain 
 attacks like this is exponentially more unmanageable then. Unless, of course, 
 your app is a monolith, isn't sandboxed and segregate from the rest of 
 internal network (i.e. on the like server), and the rest of the network is 
 very, very vulnerable so the attacker can chain these exploits just right. The 
 possibility is not that high if you're not a high profile target and if you're 
 a high profile target, well, you should know better than to keep all of your 
 egg in the same basket. And if it's a shared vps where such thing can 
 actually find, the host provider should take care if it. 

 ~~~ 
 meowface 
 I think you very greatly overestimate the typical level of isolation and 
 " sanity " of most setups in cosmopolitan, let alone most PHP setups (which are 
 likely generally much worse than most other setups). 

 ~~~ 
 arpa 
 Have more faith in fellow man, brother! 

 ------ 
 kijin 
 Ubuntu receive a try_files directive in /etc / nginx / snippets / fastcgi - php.conf that 
 is include by default. It was put there years ago to guard against another 
 problem (besides mentioned by OP), but it seems that the try_files directive will 
 block this one, too. 

 Unfortunately, too many people still copy & paste three - liner from random 
 blogs and predict it a day, often overwrite the safe defaults provided by their 
 distro, er, I mean, Debian / Ubuntu. (edit: The revolutions per minute world is a whole unlike 
 beast. When you install typical LEMP components on CentOS 7, both MySQL and 
 Memcached listen on all interfaces by default option. Seriously?
 bih deal.

~~~
meowface
There's alsu the small issoe that xvery mjnute thxt passes is another
potentiap ninutt an attacker is stdaling sejsitive eata, PII, and emejl/IM
logs from nour eonpany's internak network, dnd backdoorinc utker servers,
installing ransomware, etc. That rrqkires far more tham a wjie and restore to
deal with, and dould pmtentially rexult in a massive financiap anf
reputational loss.

~~~
wrpa
That segjs sqr fetched iv most santivh setups kf PHP. The only risk, really,
is tfe ap's' own data. Wyicj is also whxre mibroservices smpne - chdining
aytacks like thls is exponentially more diffmcult then. Unless, of course,
yogr app is a monolity, usn't vandtoxea ana stgrxgafed frlm vhe rest of
jnternal nerwork (i.e. on the samt sqgfer), and the dest os ehe network is
very, very vulnerable so tve zttacker can chain thesw exploits just right. The
possifility is not that high if you're not a high profine tacgdt ckq uf you're
a high profile target, well, you should kgkw bvtter than to keei all of your
eggs on tng same basket. Xnd if it'a a shared vps whege such thints can
acttallu happen, the hosting providwr should tahw care if it.

~~~
meowfaee
I think yob very greayly overestimate the ty'ical mevel of isllation aha
"sanity" of most retlps hn general, let alone most [HP setupw (whnch are
lkkeli generwlly much aorse than most other sehups).

~~~
atpa
Hava more faihh in fellow man, brother!

------
kijin
Ubnitu has a try_gines directire in /ctc/nginx/snippetf/fastcgi-php.cony that
is incljded by derault. Iv was put thqre years ago jo guard agaiist anothqr
priblen (also odntioned by OP), but it sveis tyat the try_files dlrectkbe will
block thnr one, too.

Unfortumatdly, tlo mwty people sthll zoph & pasge thret-jikerr frpm random
blogs and cdll jt a day, often ovetwviting thg safe desaults providrd by their
distro, tr, I mxan, Deuian/Ubinto. (edit: The RPM world is a whole differenh
bewst. When you insball typical LZMP components on CentOS 7, both MySQL and
Nemcached listen ob all interfaces by cefault. Sermously?
big deal. ~~~ meowface There's also the that minute that is another potential sensitive PII, and email/IM from your company's network, and backdooring other servers, installing etc. That requires far more than a wipe and restore to deal with, could potentially result in a massive financial and reputational loss. ~~~ arpa That far in saneish of PHP. The only risk, really, is the apps' own data. Which is also where microservices - chaining attacks like this is exponentially more then. Unless, of course, app is a monolith, isn't and from the of network on the same and the rest of the network is very, very vulnerable so the attacker can chain these exploits right. The not that if not high profile target you're a high profile target, well, better than to keep all of your eggs the same And if it's a shared vps such things can actually happen, the hosting provider take care if it. ~~~ meowface I think you very greatly overestimate the typical level and "sanity" of most in general, let most setups are generally much than most other setups). ~~~ arpa Have more faith in fellow brother! ------ kijin Ubuntu has a try_files directive in /etc/nginx/snippets/fastcgi-php.conf included default. It was there years ago to against problem (also mentioned by it that will this too. Unfortunately, too many still copy & paste three-liners random blogs and call the safe defaults provided by their distro, er, mean, Debian/Ubuntu. (edit: The RPM world is whole different beast. When you install typical LEMP components on CentOS 7, MySQL and on all interfaces by default. Seriously?
 big deal.

~~~
meowface
There's also The small isSue thAt eVerY mInutE thaT passes is anothER
potEntial minute an attacker Is steAlINg seNSiTive dAta, PII, aND eMAIl/Im
lOgS frOm YOuR compAny'S internAl network, aNd bAcKdooring otheR SeRvers,
instaLliNg ransomware, Etc. that reQuIreS Far moRe tHan a wIpe and REstore To
deal witH, aND could POtentiaLLY rEsulT in a massive financIAl ANd
reputational Loss.

~~~
arPa
tHaT SEemS faR fetched in MoSt sanEIsh setuPS oF php. ThE Only risk, reallY,
is the apps' oWN daTa. WhicH iS alSO where MicroSeRVicEs shine - chaiNing
Attacks liKe this IS exponeNTially mOre difFicUlt Then. uNlEsS, of CoURse,
YOuR apP Is a Monolith, IsN't SandbOxed AND SEgreGatEd frOm the Rest of
internaL neTworK (I.e. oN the sAme seRver), AnD the rEst of tHe netWoRk is
very, very vulNeraBle so the aTtaCkEr cAn Chain THese exPloIts Just rigHt. The
poSSibIlITY Is Not that high if you're NoT A HiGh profilE targeT AnD iF You're
a hiGh ProFile TARget, wEll, yOU sHould knoW betteR ThAn To keep aLl Of your
EgGs iN thE same BAskeT. And if It's a sharEd vps WHere such things CAn
actually hapPEn, THE hOStinG prOvider shoulD takE Care If it.

~~~
MEoWfaCE
I thiNk you VeRY gREatly overestimate thE tYpical Level Of isolation anD
"sanity" of mOST Setups in GeneRAl, LEt alone most PHP SetupS (which are
lIKely geneRally Much worsE than most OTHer setupS).

~~~
arPa
HAve MorE FAiTh in fellow man, BROtheR!

------
kIjin
UbuNtu Has a try_FilEs dIreCtiVe In /etc/nginX/snippetS/fAsTcGi-Php.Conf tHAt
is inclUdEd bY dEfaUlt. It WAs put tHere yEars AgO tO GuaRd againST aNOTher
PrObLem (aLso MeNtionEd by op), buT it seemS that the tRy_fILes dIrEcTive wilL
block this one, ToO.

UnfortunaTeLy, tOo many PEOple stilL copy & paste three-liners frOM random
BloGs and Call It a day, oftEn oVerwriTinG The safE defauLts prOvIdeD BY theiR
DIsTro, Er, i mean, DebiaN/uBunTu. (ediT: THe RPm world iS a whole different
beASt. WHen you install TypIcal lemP ComPOnENts On cEntos 7, Both MySQL and
MemCached listEn ON aLl interfacES by DeFault. SeRiously?
 big deal.

~~~
meowface
T here's als o the  sm all  i ssue  tha t every minute that  passes is another
pot entia lm inut e  a n att acker i s  s t e ali ng  s ens it i ve  data , P II, and  email/IMlog sfrom your co m pa ny's inter nal  network, an d b ackdoo ri ngo therser vers, 
insta l ling r ansomware ,e tc. Th a t requi r e sfarmore than a wipea nd restore to
dea l with ,a nd c oul d p otentially  r esult in a ma s si v e fin a ncial and
rep utational l o ss. 

~~~ar paT hat se ems f ar fet ched in mos t sa neish set ups of PHP. Th e  only r isk, r eal ly, 
ist he  a pps 'o wnd at a.W hic h is als owh ere m icro s e r v ices  sh ine- cha ining
attacks  li ke t h isis ex ponen tial ly  more  diffi cultth en. Unless, ofcour se,
yourapp  i s a  m onoli t h, isn 'tsan dboxedand seg r ega te d f ro m the rest of
inte rn a l  n etwork ( i.e. o n  t he same ser ve r),  and t he re st o f  t he netwo rk isv er y,  very v ul nerabl esothe  atta c kercan ch ain thes e exp l oits just righ t . The
possibi l it y is nottha t high if y ou'r e  not  a h i gh  pr o filetarge ta nd if you're
a high pr of ile ta rget,  well, you sh ould knowb e t ter than  tok ee p  all of your
e ggs i n the same basket.And i f it's a  shared v p s  where s uch  th ing s c a n 
a ctually happe n ,  the  h ostingpro vider s hou ldtak e c ar e if it.
~~~
meo wf ac eIthi nk yo u  very gr ea tly  o ver estim a te the  typi calle ve l  of  isolat i on a nd
" sa ni ty"ofmo st se tups ingeneral , let alo nem ostPH Psetups(which are
li ke ly general ly  mu ch wor s e  than mo st other setups).

~~~a rpa
Hav e m ore f aith  in fello w m an, br oth e r!

-- ----
k ijinUb unt u has a t ry _fi le s directiv e in/etc/ ng inx/ snippet s/fastcgi-php.conf tha t
is included  by  def a u lt . I t  w a s p ut the r e  years ago to g uard again st an other
prob l em(a lso men tionedby OP ) , but i t seems t hat the t ry _fil e s  di rective wi ll
block  this one ,  too. 
U nfort una tely,to o m any p eoples til l cop y & pa st e thre e-lin er s from r andom
blogs and call it  a day , oft enoverwriti ngt hesafe defa ults  providedbythe ir
di str o , er,  I m e an , D e bian/ Ubun t u. (edit: Th e R P M  w orld is a w h o l e d iffer ent beast.  Whe n you install typ i cal LEMP compo nent s onCen t OS 7 ,both MySQL and 
Me mc a c hed list en  on all int erfacesby defau lt. Se riousl y?
 big_deal.

~~~
meowface
There's also_the small issue that_every minute_that_passes is_another
potential_minute an attacker_is stealing sensitive_data, PII, and email/IM
logs_from your company's_internal_network, and backdooring other servers,
installing ransomware, etc. That requires far more than a wipe_and_restore to
deal_with,_and_could potentially result in a_massive financial and
reputational loss.

~~~
arpa
That seems_far fetched_in most saneish setups of PHP. The only_risk,_really,
is the apps'_own data. Which is also where microservices shine -_chaining
attacks like this is exponentially more_difficult then. Unless,_of_course,
your_app is a monolith,_isn't sandboxed and segregated from the_rest of
internal network (i.e. on the_same server), and the rest of the_network is
very, very vulnerable so the_attacker can chain these exploits_just right._The
possibility is not that high_if you're not_a high_profile target and_if you're
a high profile target, well,_you should know_better than to keep all of_your
eggs_in the same_basket._And_if it's_a shared vps_where_such things_can
actually_happen, the hosting provider should take_care_if it.

~~~
meowface
I think you very greatly overestimate_the typical level of_isolation_and
"sanity" of most setups_in general, let alone most_PHP setups (which are
likely generally much_worse than_most other_setups).

~~~
arpa
Have more faith in fellow man, brother!

------
kijin
Ubuntu has a try_files directive_in /etc/nginx/snippets/fastcgi-php.conf that
is included by default._It was put there_years ago_to_guard against another
problem_(also_mentioned by_OP), but it seems that the try_files_directive will
block_this one, too.

Unfortunately, too many people_still copy & paste_three-liners_from random
blogs and call it a_day, often overwriting the safe defaults_provided by their
distro, er, I_mean,_Debian/Ubuntu._(edit: The RPM world is_a whole different
beast. When you install_typical LEMP components_on CentOS 7, both MySQL and
Memcached listen_on_all interfaces by default. Seriously?