1

iDevAffiliate affiliate software provides affiliate program software to start affiliate tracking. It is protected by ioncube which makes it quite hard to audit the code for vulnerability.

It is the point of entry for an attack which culminated in a php shell being uploaded, reflected in HTTP logs.

Unfortunately I am not able to easily replace or disable the software. I am wondering if I can "brick" it so that it can be effectively "jailed" in place.

Can php applications be chrooted?

  • I assume that this is in support and that you have raised this as an issue with the vendor? Seems like a serious vulnerability. If the vendor doesn't respond, I'd recommend taking to Twitter and telling them there publicly. I've found this to be a very effective last resort to get vendors to respond since it generates a large amount of negative publicity very quickly. – Julian Knight Dec 28 '16 at 17:50
  • You could put a reverse proxy in front of it that would filter out malicious requests. – André Borie Feb 27 '17 at 1:57
1

It shouldn't really matter if a user is able to upload a PHP shell; you shouldn't ever be executing user-uploaded files. That is, separate them out into an entirely different area than your code so that the webserver won't interpret them. You can do this with scoped config rules, depending on your webserver, but an even better approach is to put them directly onto a separate datastore (say, S3) and use a separate domain to serve them, either directly from that service or via a CDN as intermediary.

  • Agree, just make sure that the server will not execute PHP or even serve HTML from the upload location. You could also try changing permissions on the folder to prevent the upload. – Julian Knight Dec 28 '16 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.