Re: [gentoo-user] apache2 AddHandler/SetHandler vulnerability

[Michael Orlitzky <mjo@gentoo.org>]

On 04/25/2015 05:23 PM, Grant wrote:
> I read about this vulnerability in the
> 2015-04-06-apache-addhandler-addtype Gentoo news item.  I don't think
> I'm using any functionality that could expose me to the problem but
> I'd like to be able to say so for sure.  Does the fact that I'm
> up-to-date with GLSAs, I don't have PHP5 in APACHE2_OPTS (I use
> php-fpm), along with the following (which I think is default) indicate
> that I'm not vulnerable?

(1) Do you allow untrusted people to upload files to your server?

(2) If so, do you try to prevent them from uploading PHP files
    based on a regular expression or shell glob?

Unless you answer "yes" to both of those questions, you don't need to
check anything.

The vulnerability is that with,

  AddHandler application/x-httpd-php .php

Apache will go ahead and try to execute (for example) foo.php.html. If
you're blocking uploads of *.php to prevent people from uploading PHP
scripts, then I could name my file foo.php.html and bypass your restriction.

The AddHandler behavior was documented, but incredibly unexpected -- and
we had it in the default configuration. The new config we ship uses,

  <FilesMatch "\.php$">
    SetHandler application/x-httpd-php
  </FilesMatch>

instead so only *.php files get executed.