Extract: A PHP Foot-Gun Case Study
summary
Claims that extract routinely enables attackers to overwrite important variables, backed by a static-analysis pass over a code property graph and manual review of flagged cases. The study scans 28,325 projects, finds ~5,000 extract calls (1,300 projects using extract), narrows to 303 repos with user input and 146 risky calls, and reports 154 injection vulnerabilities, 86 control-flow hijacks including 60 privilege escalations. The authors build and validate the scanner and propose mitigations (prevent global overwrites, whitelist keys); removal is impractical due to PHP compatibility.
AI-written summary · about
chapters (14)
- 0:00Extract function in PHP
- 1:14How extract transforms arrays
- 3:23Extract vulnerabilities CTF demo
- 4:05User input in PHP apps
- 6:17Finding extract in codebases
- 8:25Static analysis results 28k repos
- 10:13SQL injection via extract
- 12:44Exploiting _SERVER and _SESSION
- 14:52Privilege escalation via sessions
- 17:21PHP app vulnerabilities
- 18:25Extract popularity in PHP
- 19:06Mitigations for extract misuse
- 21:13Conclusion and takeaways
- 21:56Q&A
related talks
42mContemporary Automatic Program Analysis
16mFIXX: FInding eXploits from eXamples
01h 01mHow hacking works - Web edition
35mPHP is evil (Defensive programming)
42mOops, there's someone in my package manager!
02h 18mWeb application security (Part 2)
25mThe Voight-Kampff Test for Discovering Vulnerabilities
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain