Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kimai/kimai | composer | <= 2.57.0 | 2.58.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the Kimai Docker image used a default, publicly known APP_SECRET. This secret is used by the underlying Symfony framework to sign security-sensitive information like remember-me cookies and login links. An attacker who knows this default secret can forge these and take over any user account.
The primary fix is not in the PHP application code, but in the Docker environment. The 31a8f887a5cda517db7b4320a7ad997c87d08601 commit addresses this by:
APP_SECRET from the Dockerfile..docker/entrypoint.sh named ensureAppSecret that generates a unique, random secret if one is not provided by the user. This ensures that every installation has a unique secret.While no single PHP function is inherently vulnerable, the exploitation of this misconfiguration would involve the application processing a forged remember-me cookie or a forged login link. The functions that would appear in a runtime profile during such an attack are:
Symfony\Component\Security\Http\RememberMe\TokenBasedRememberMeServices::processAutoLoginCookie: This Symfony function is responsible for handling the remember-me cookie. During an attack, it would process a cookie forged by the attacker, leading to unauthorized access.Symfony\Component\Security\Http\Authenticator\LoginLinkAuthenticator::authenticate: This Symfony function handles authentication via login links. An attacker could craft a login link for any user, and this function would process it, granting access.Additionally, the patch includes a defense-in-depth measure in config/packages/security.yaml which changes the signature_properties for login links to include the user's password hash. This makes login links dependent on the user's password, so they cannot be forged with just the user's ID, even if the APP_SECRET were known.
Symfony\Component\Security\Http\RememberMe\TokenBasedRememberMeServices::processAutoLoginCookievendor/symfony/security-http/RememberMe/TokenBasedRememberMeServices.php
Symfony\Component\Security\Http\Authenticator\LoginLinkAuthenticator::authenticatevendor/symfony/security-http/Authenticator/LoginLinkAuthenticator.php