Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because the tmp library did not correctly handle symbolic links when validating user-provided directory paths. The root cause is in the _resolvePath function, which used path.resolve instead of a function that resolves symbolic links, like fs.realpathSync. This allowed an attacker to specify a dir option that is a symbolic link pointing to a location outside of the intended temporary directory, bypassing the security checks in _assertIsRelative.
The exploitation of this vulnerability occurs through user-facing functions like fileSync, dirSync, and their asynchronous counterparts (file, dir), which all rely on the flawed path validation logic. The provided patch addresses the issue by removing the vulnerable _resolvePath and _assertIsRelative functions and replacing them with new logic (_resolvePathSync, _getRelativePathSync) that correctly resolves symbolic links using fs.realpathSync before performing the validation checks. Therefore, any function that creates temporary files or directories using a user-supplied dir option was vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tmp | npm | <= 0.2.3 | 0.2.4 |
