PRP: Request PHP 8.1.0-dev User-Agentt Backdoor

[wdjcy]

Hello,

I would like to start the implementation for a plugin that detects PHP 8.1.0-dev User-Agentt Backdoor

Vulnerability details:

Type: PHP 8.1.0-dev User-Agentt Backdoor
Score: 9.80 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:

• https://news-web.php.net/php.internals/113838
• php/php-src@c730aa2
• php/php-src@2b0f239

The vulnerability should be remotely exploitable without authentication and user interaction. Yes

The detector should provide a reliable false-positive free detection report. Yes

The detection capability should be easy to verify using both vulnerable and fixed Docker images. Yes, this can be done easily.

The vulnerability should have a relatively large impact radius. Yes, PHP server is widely used more than 6993K+ Instance are exposed in shodan

Please let me know if this is in scope as I've already made the development .