Disabling any request body processing with #Vinyl_Cache to avoid the #php RCE is simple:
sub vcl_recv {
if (req.http.Content-Length || req.http.Transfer-Encoding) {
return (synth(403, "No req body"));
}
}
#vinyl_cache
4 posts · Last used 14d
Replying to
So one option in #Vinyl_Cache is to check if you have any such requests:
vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form'
vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form'
The first command scans the in-memory log, the second runs until interrupted on live data.
If you do not see multipart/form-data requests, you can simply refuse them in VCL.
#php2shell
Replying to
Another very simple option in #Vinyl_Cache is to limit the size of request bodies using std.cache_req_body(). This also has the added benefit that chunked transfer encoding is tuned into a request with a content-length, such that php can check it upfront against the maximum body size.
In the example, the maximum size should be adjusted accordingly.
#php2shell
New short article: How #Vinyl_Cache can help with #php2shell
You've seen all posts