Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/projectdiscovery/nuclei/v3 | go | >= 3.0.0, < 3.10.0 | 3.10.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a result of a multi-pass evaluation of template expressions, where data from an untrusted source, such as a target server's response, could be re-evaluated as new template syntax. This allowed a malicious server to craft a response containing expressions like {{env_var_name}}, which would be resolved on the scanner's machine during the second evaluation pass, disclosing environment variables if the -ev flag was enabled.
The analysis of the patch ccbfb12bd01447ba25f6e755dfb2bee677736da6 identifies the key functions involved:
Rule.executeEvaluate in pkg/fuzz/parts.go: This function was the primary trigger for the vulnerability in the DAST/fuzzing context. Its logic explicitly performed a two-step evaluation, feeding the result of the first evaluation back into the expression engine. This is where the malicious server response was improperly re-processed as a new template.
expressions.Evaluate in pkg/protocols/common/expressions/expressions.go: This was the underlying unsafe utility function. It performed a naive string replacement of variables before compiling and executing the expression. This flaw meant that any value containing expression syntax would be executed, rather than being treated as a literal string. This function was used by Rule.executeEvaluate and other parts of the codebase.
Matcher.MatchDSL in pkg/operators/matchers/match.go: This function also used the flawed expressions.Evaluate primitive, making it another potential vector for the same type of vulnerability within the context of DSL matchers.
During exploitation, a runtime profile would show calls to Rule.executeEvaluate (in a fuzzing scenario) which in turn calls the vulnerable version of expressions.Evaluate. The patch addresses the vulnerability by refactoring the evaluation logic to be single-pass and by hardening the underlying expression evaluation to properly escape runtime data.
Rule.executeEvaluatepkg/fuzz/parts.go
expressions.Evaluatepkg/protocols/common/expressions/expressions.go
Matcher.MatchDSLpkg/operators/matchers/match.go