Added features on test-gc + 2 doctrine-bundle RCE #140
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
test-gc-compatibility.py improvements
I adapted test-gc-compatibility.py and added some features on it.
Taking the PHP version in consideration
test-gc was installing the packages with the option
--ignore-platform-reqs
which installed the packages without taking in consideration the version of PHP running the payloads, which can cause some issues if incompatible packages are installed, in my case it broke the dependencypsr/log
and installed the latest, even if it is not compatible with PHP 7.4.So I replaced it with the option
--ignore-platform-req=ext-*
which takes the PHP version in consideration but ignores PHP extensions requirements.Give details on the PHP version which runs test-gc
Since the PHP version on which the gadget chain runs can cause unexpected issues, I printed it at the start of test-gc to make it easier to debug.
Selecting specific package versions
Before this update, running test-gc on packages with a ton of version such as
symfony/symfony
could take hours.You can now specify the versions you want to test by using the following syntax.
Docker compatibility for test-gc-compatibility.py
Require packages to use
test-gc-compatibility.py
in theDockerfile
were added, you can run it from docker with the following syntax.Two gadget chains on the doctrine/doctrine-bundle package
I also added two gadget chains working on several
doctrine/doctrine-bundle
versions, Doctrine/RCE1 works from version 1.5.1 to version 2.7.2, Doctrine/RCE2 works from version 1.11.0 to version 2.3.2.Since the PHP version has an influence on the chain Doctrine/RCE1, here are the
./test-gc-compatibility.py
result on PHP 7.4.33 and 8.1.13 :On PHP 7.4.33 :
On PHP 8.1.13 :