lgcosta
6370227ad1
Ferramenta em portugues para avaliar hosts frente as CVE-2026-109618 (RCE via corrupcao por OOM) e CVE-2026-109619 (RCE via estado global obsoleto), publicadas pelo projeto PHP em 21/10/2026. Conteudo: - varredura: fingerprint de versao e SAPI, exposicao de phpinfo e veredito por alvo, com saida texto/JSON - sondas ativas controladas: "leve" reproduz o OOM pre-RINIT do bundle oficial de reproducao; "forte" usa chunked para verificar o patch por comportamento (o parser corrigido corta a leitura em post_max_size). Cada sonda vem com um corpo de controle para atribuir o OOM ao caminho de progresso de upload de sessao - config: auditoria de php.ini, .user.ini, .htaccess e pool FPM contra as recomendacoes do aviso oficial do PHP - info: referencia rapida das CVEs, versoes corrigidas e mitigacoes - laboratorio: sobe containers (8.2.34 vulneravel, 8.2.35 corrigido, controle com upload_progress desligado e par nginx+php-fpm) e valida o verificador com recibos PASS/FAIL As versoes corrigidas vem do advisory oficial (8.2.35, 8.3.36, 8.4.27, 8.5.12) e nao do post de referencia, que lista as versoes anteriores. A ferramenta mede exposicao: nao inclui a forja de ponteiros nem a chamada a system() do bundle de reproducao. Testes: 46 testes unitarios (unittest, sem dependencias).
22 lines
1.0 KiB
Plaintext
22 lines
1.0 KiB
Plaintext
MIT License
|
|
|
|
Copyright (c) 2026 Luiz Gustavo Costa
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
of this software and associated documentation files (the "Software"), to deal
|
|
in the Software without restriction, including without limitation the rights
|
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
copies of the Software, and to permit persons to whom the Software is
|
|
furnished to do so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in all
|
|
copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
SOFTWARE.
|