There's somebody in my package manager!
summary
Concrete compromises against PHP package infrastructure: the researchers exploit a VCS argument-injection to get a remote shell via VCS argument-injection, alter package metadata and force installs (two successful breaches of packages.org in Apr 2021 and Apr 2022); they exploit a weak reset-token RNG to take accounts in about 50-try password reset takeover, then chain a CVE in archive_tar using symlinks to tar symlink write to webroot and drop a PHP webshell. Fixes ship quickly for packages but pear deployments lag; recommendation: mandatory artifact signing (sigstore).
AI-written summary · about
chapters (5)
- 0:00Package manager security risks
- 5:59Composer backend server compromise
- 27:57PEAR vulnerabilities exploited
- 45:26Preventing supply chain attacks
- 58:13Acknowledgments
related talks
42mOops, there's someone in my package manager!
38mSecurity And Modern Software Deployment
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
45mKnow Your Enemies: Live Exploit of a PHP Engine Security Breach
40mHow to hack a node app?