Plesk RCE Güvenlik zafiyeti - Sayfa 2

Dün, 23:55:38

#10

🎩 SMM PANEL YAZILIMI 🎩

7.4 e patch gelmedi galiba build numarası değişmiş ama geldi gelmedi bir şey bulamadım şunu yapalım.

for v in 7.4 8.3 8.4; do
  echo "===== PHP $v ====="
  grep -n 'session.upload_progress.enabled' \
    /opt/plesk/php/$v/etc/php.ini 2>/dev/null
done

Çıktı ;

===== PHP 7.4 =====
1512:;session.upload_progress.enabled = On
===== PHP 8.3 =====
1554:;session.upload_progress.enabled = On
===== PHP 8.4 =====
1443:;session.upload_progress.enabled = On

for v in 7.4 8.3 8.4; do
  d="/opt/plesk/php/$v/etc/php.d"
  if [ -d "$d" ]; then
    printf '%s\n' 'session.upload_progress.enabled = Off' \
      > "$d/99-security-mitigation.ini"
    echo "PHP $v: ayar eklendi"
  else
    echo "PHP $v: php.d dizini bulunamadı"
  fi
done

systemctl restart plesk-php74-fpm
systemctl restart plesk-php83-fpm
systemctl restart plesk-php84-fpm

Kontrol ;

for v in 7.4 8.3 8.4; do
  echo "===== PHP $v ====="
  /opt/plesk/php/$v/bin/php -i 2>/dev/null \
    | grep '^session.upload_progress.enabled'
done

Çıktı ;

done
===== PHP 7.4 =====
session.upload_progress.enabled => Off => Off
===== PHP 8.3 =====
session.upload_progress.enabled => Off => Off
===== PHP 8.4 =====
session.upload_progress.enabled => Off => Off

https://discuss.flarum.org/d/40140-advisory-php-vulnerabilities/2