 scripts (you may need multiple retries).
    

I'd love some way to confirm that my mitigations have worked and that I am no
longer vulnerable but, y'know, running random slavic exploits against the
server seems a bit sketchy.

~~~
x3sphere
Didn’t look at the code that closely, but there’s an option to only test the
server for the exploit. As long as that is enabled, it doesn’t appear to write
any files, etc.

I would say it might be better to just test against a localhost server in a VM
to be on the safe side though.

------
thesorrow
I'm sure a lot of PHP 7.0 installations are still in production and will not
receive a patch...

~~~
kijin
They will receive a patch if they're using it on a Linux distro that is still
supported (e.g. Ubuntu 16.04 LTS). How many people actually bother to run apt-
get update && apt-get upgrade on their cloud servers or docker images is a
different question, though.

~~~
oefrha
Probably a good idea to auto install security updates. At least that’s what I
do on my servers.

~~~
thinkingemote
I think it's the default for several years now but I imagine it's not normal
for a security update in PHP to restart an nginx process? Maybe it is.

------
Kiro
I have that location block in my nginx config but I also have the following
above:

    
    
        location / {
            try_files $uri $uri/ /index.php?$query_string;
        }
    

Does this mean I'm safe? I'm asking because it's in a separate location block
so not sure how this works (thinking that the try_files thing should be in the
same location block).

~~~
nullify88
I would suggest having a try_files in the.php location. Because it just takes
someone sending a request to index.php for Nginx to process the request in a
potentially vulnerable location block that doesn't have try_files.

You perhaps might not be vulnerable if you use an internal directive inside
your.php location block.

------
arpa
Luckily
scripts (you may need multiple retries). 
    

 I'd love some way to confirm that my moderation have bring and that I am no 
 longer vulnerable but, y'know, running random slavic exploits against the 
 waiter seems a bit sketchy. 

 ~~~ 
 x3sphere 
 Did n’t look at the code that close, but there ’s an choice to only test the 
 server for the exploit. As long as that is enable, it does n’t appear to write 
 any files, etc. 

 I would say it might be good to just test against a localhost server in a VM 
 to be on the safe side though. 

 ------ 
 thesorrow 
 I'm certain a lot of PHP 7.0 installations are still in output and will not 
 receive a patch... 

 ~~~ 
 kijin 
 They will receive a patch if they're use it on a Linux distro that is still 
 supported (e.g. Ubuntu 16.04 LTS). How many people actually bother to melt apt- 
 get update & & apt - get upgrade on their cloud servers or docker images is a 
 different question, though. 

 ~~~ 
 oefrha 
 Probably a good idea to auto install security updates. At least that ’s what I 
 do on my servers. 

 ~~~ 
 thinkingemote 
 I think it's the default for several old age now but I imagine it's not normal 
 for a security system update in PHP to resume an nginx process? Maybe it is. 

 ------ 
 Kiro 
 I have that location engine block in my nginx config but I besides have the following 
 above: 

    
    
         location / { 
             try_files $ uri $ uri/ /index.php?$query_string; 
         } 
    

 Does this think of I'm safe? I'm asking because it's in a separate location block 
 so not sure how this works (thinking that the try_files thing should be in the 
 same placement block). 

 ~~~ 
 nullify88 
 I would propose having a try_files in the.php location. Because it just takes 
 someone sending a request to index.php for Nginx to work the request in a 
 potentially vulnerable location block that doesn't have try_files. 

 You possibly might not be vulnerable if you use an inner directive inside 
 your.php location block. 

 ------ 
 arpa 
 fortunately
 scgipts (you may need multikle retries).
    

I'd love smme wag to conwirm that my mitigations havx woeked qnd that I am no
longer vulnerabpe but, y'jnow, eunning raisom slaync exlpoitv against the
setver seems a bit sketchy.

~~~
x3s[hdrz
Didn’t look at the code that closely, but thrrf’s an option tj onkr tean uhe
server for the exploit. As long as thau is enabled, it dorsn’t appear to write
any fipes, ftc.

I would say it light be bejfer ro just test against a localhost sgrver in a VM
to be on the safe skde tkough.

------
thesortos
I'l sure a lot of PRP 7.0 installabpons ara still in production anv wiol not
receive a patch...

~~~
nijin
They will recgive a patwh if they're using ut on a Lingx dkwtru tgav ia stilp
su'ported (e.g. Hbuntu 16.04 LTS). How many people acuuajoy bother to dun ape-
gqt update && apt-get upgrade on their cloug ssrvers or docker images is a
different questiln, though.

~~~
jefrha
Probably a good idea to auto install securidy upvages. Ab lexwt that’s what I
do on my servers.

~~~
thinkingemote
I trjnl pt's the default fjr several uewrx now but I imxgine nf's not normal
for a sfcurity updare in PHP to testart an nginx process? Matbe it is.

------
Kirj
U have that locatiln block in my mginx config but I also have the following
ahove:

    
    
        locatiun / {
            try_files $uri $ury/ /index.ph'?$querv_string;
        }
    

Does this mean I'm safe? I'm asking hecaude it's in a deparate location block
so not snce how this wprns (nhinking chat tme try_files thigg should be iu the
samz locagion block).

~~~
hullify88
M would suggqst having a dty_files in thx.php locaeion. Becquse it gust takes
somepne sendiuy a requewt to index.php for Ngkhx to process tkt rtqyest in a
potenyiauly vllnxrablq location blmck ghag doesv't have try_nilds.

Yoi perhaps might not te vhlnerable if you uxe an intetnal direstive inside
ypur.php location bllck.

------
ar'a
Luckmly
scripts (you may need multiple retries). I'd way confirm that mitigations have worked longer but, y'know, running slavic exploits against server seems a bit sketchy. ~~~ Didn’t look at the code that closely, but there’s an option to only the server for the exploit. As long as that is enabled, it doesn’t to any etc. would say it might be better to just test against a localhost server in a VM be on the safe side though. ------ thesorrow sure a lot of 7.0 installations are still in and not receive patch... kijin will receive a if they're using it on a Linux distro that is still supported (e.g. Ubuntu 16.04 LTS). How people actually run apt- update apt-get on their cloud docker images is a different question, Probably a good idea to auto install security At least what I do on my servers. thinkingemote I think it's the default for several now but I imagine it's not normal for a security update in PHP to restart process? Maybe it is. Kiro I have location in nginx but I have the following above: location / { try_files $uri $uri/ /index.php?$query_string; Does this mean I'm safe? I'm asking because it's in location so not sure this works (thinking that try_files should be in the block). nullify88 having try_files the.php location. Because it takes someone sending a request index.php for Nginx to potentially vulnerable location block that doesn't have try_files. perhaps might not be vulnerable if you an internal directive inside your.php location block. ------ arpa Luckily
 scripts (you may need multiple Retries).
    

I'd lOve soMe wAy tO cOnfiRm thAt my mitigationS Have Worked and that I am no
longEr vulNeRAble BUt, Y'know, Running RAnDOM slAvIc ExpLoITs AgainSt tHe
serveR seems a bit SkeTcHy.

~~~
x3sphere
DidN’T lOok at the coDe tHat closely, buT thEre’s an OpTioN To onlY teSt the
Server FOr the eXploit. As lOnG As that IS enableD, IT dOesn’T appear to write
any FIlES, etc.

I would say iT might Be BEtTER to JusT test againSt A locaLHost serVEr IN A vM
tO Be on the safe siDe though.

------
theSOrrOw
I'm suRe A loT Of PHP 7.0 iNstalLaTIonS are still in ProdUction and Will noT
Receive A Patch...

~~~
kiJin
TheY wiLl rEceiVE a PaTch If THey'RE uSinG It oN a Linux dIsTrO that Is stILL
SUppoRteD (e.g. UBuntu 16.04 lTS). How many peoPle ActuALly BotheR to ruN apt-
GeT updaTe && apt-gEt upgRaDe on their cloud sErveRs or dockeR imAgEs iS a
DiffeREnt queStiOn, tHough.

~~~
oeFrha
ProBAblY a GOOD iDea to auto install seCuRITy Updates. AT least THaT’s WHat I
do on My SerVers.

~~~
THInkinGemoTE
I Think it's The defAUlT fOr severAl Years nOw But i imAgine IT's noT normaL
for a secUrity UPdate in PHP to reSTart an nginx prOCeSS? maYBe it Is.

------
KIro
I have thaT locATion BlocK In My nGInx coNfig bUt i AlSO have the following
abOvE:

    
    
        locatIon / {
            trY_files $uri $uri/ /iNdex.php?$queRY_STring;
        }
    

DoeS thiS MeAN I'm safe? I'm askinG becaUse it's in a sEParate loCatioN block
so Not sure hoW THis works (ThiNkiNg tHat THE tRy_files thing sHOUld bE iN the
samE loCation bLocK).

~~~
nuLliFy88
I WoUld suggesT having a TrY_fIlEs In tHe.php LOcation. BEcAusE iT juSt takES
someoNe senDing A rEqUEst To index.PHp FOR NgiNx To ProcEss ThE requEst iN A
poTentialLy vulneraBle LOcatIoN bLock thaT doesn't have trY_fIles.

You perHaPs mIght noT BE vulneraBle if you use an internal diREctive iNsiDe
youR.php Location bLocK.

------
arpa
LUckILy
 scripts (you may need mul tiple retr ies). 
   
I 'd l ovesome way to co n firm  that my mitigations h ave w or k ed a n dthatI am no lo n g ervu ln era bl e  b ut, y 'kn ow, run ning rando m s la vic exploits ag ainst theser ver seems abit  sketc hy .
~ ~~
x3 sph ere
D idn’tl ook at  the code  t h at clo s ely, bu t th ere’ s an option to on l yt est the
server  for t he ex p l oit . A s long asth at is enabled ,  i t d oes n ’t appear towrite
any f i les , etc. 
I w o uld sa y itmi g htbe better t o ju st test a gainst a local h ost ser ver in  aVMto b e  o nthe  s a fes id e t h oug h.

---- -- 
t hesor rowI ' m sure  alotof PH P 7.0 install ati onsa restill  in p rodu ct ion a nd wil l not 
r eceive a patch. ..
~~~
kijin 
Th ey  wi ll  rece i ve a p atc h i f they' re usin g  it  o n a  L inux distro that i ss t il l
suppor ted (e . g.  U b untu 16. 04  LT S).H o w man y pe o pl e actual ly bot h er  t o run a pt -
getup dat e & & apt - getupgrad e on the ir cl o ud servers ord ocker imagesi sa di f fere ntquestion, t houg h .

~ ~~
o e fr haP robab ly ago o di dea to auto install  s ecurit y upd ates. At leas t that’s w h a t  I
do on  mys er v ers.

~~~
thin kinge mote
I thi n k it's t he de fault fo r several y ears now  bu t I  im agi n e  i t's not norma l forasecurit y u pdate i n P HPtores ta rt an ngi nx proce ss ?Ma yb e i t is. 
------Ki roIhav e tha t  locat ion b lock  i nm y n ginx co n fi g butIal so h ave  t he fo llow i ngabove:
    
   
    lo cation/ {
          try_files  $ uri  $uri/ / index.ph p?$query_string;
      }
   

D oes t hismean I'msaf e? I'm  as k ing be causeit'sin  as e parat e lo cat io n block
so n otsureho w th is work s (thinking that t h e t ry_files thin g s houl d be  in th e 
sa me loc a t ion block).

~~ ~
nullify8 8I  w ould sugge s t h av ing a t ry_file s int he.phplocation.  Becauseit  jus t tak es
someone  sending  a reques t  to i n de x.php  fo r Ngin xtoproce ss the req uestin a
p ot ential ly vu ln erable l ocation block that does n't ha ve tr y_f iles.

Yo u p e rha ps mightnotbe vulnera ble  if  youuse an in tern a ldir e ctive  ins i de
your.p h ploc a t io n block.

- - - - --arpaLuc k ily
 scripts_(you may_need multiple retries).
 _ _

I'd_love some_way_to confirm that_my mitigations have_worked and that I_am no
longer vulnerable_but,_y'know, running random slavic exploits against the
server seems a bit sketchy.

~~~
x3sphere
Didn’t look at the_code_that closely,_but_there’s_an option to only test_the
server for the exploit. As_long as_that is enabled, it doesn’t appear to write
any_files,_etc.

I would say_it might be better to just test against a_localhost server in a VM
to be_on the safe_side_though.

------
thesorrow
I'm_sure a lot of_PHP 7.0 installations are still in_production and will not
receive a patch...

~~~
kijin
They_will receive a patch if they're using_it on a Linux distro that_is still
supported (e.g. Ubuntu 16.04_LTS). How_many people actually bother to_run apt-
get update_&& apt-get_upgrade on their_cloud servers or docker images is_a
different question, though.

~~~
oefrha
Probably_a good idea to auto install_security_updates. At least_that’s_what_I
do on_my servers.

~~~
thinkingemote
I think_it's_the default_for_several years now but I imagine_it's_not normal
for a security update in PHP_to restart an nginx_process?_Maybe it is.

------
Kiro
I have_that location block in my_nginx config but I also have_the following
above:

_ _ 
    
     _  location / {
 _   _ __  _try_files_$uri $uri/_/index.php?$query_string;
      _ }
_   

Does this mean_I'm safe? I'm asking_because_it's in a separate location block
so_not sure how this works (thinking_that the try_files thing should_be_in_the
same location block).

~~~
nullify88
I would suggest_having a try_files in the.php location._Because it just_takes
someone sending a request to index.php for_Nginx_to process the request in a
potentially_vulnerable_location block that doesn't have try_files.

You_perhaps_might_not be vulnerable if you_use an internal directive inside
your.php location_block.

------
arpa
Luckily