Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided security advisory and the associated commits (470d34b1de87d901bd9135564d5ee18c0d339e82 and d7bc52beeadff4be5f5690de4d5de42abd10affe) points directly to the ApplyDiffPatch function in services/repository/files/patch.go as the source of the vulnerability. The vulnerability description explicitly mentions that the diffpatch endpoint is abused by applying patches in a 'shared bare temporary clone'. The patch diff confirms this was the case. The original code called t.Clone(ctx, opts.OldBranch, true), where the true argument indicates a bare clone. The fix changes this to false and adds a comment explaining why a bare repository is dangerous in this context. This allowed an attacker to write a malicious git hook into the .git/hooks directory, which would then be executed by the git process, resulting in remote code execution. The vulnerable function is therefore services/repository/files.ApplyDiffPatch as it was responsible for this insecure sequence of operations.
services/repository/files.ApplyDiffPatchservices/repository/files/patch.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitea.dev | go | >= 1.17.0, < 1.27.1 | 1.27.1 |