Oops, there's someone in my package manager!
summary
Presents multiple vulnerabilities in PHP package infrastructure: command‑argument injection in VCS tooling used by Packagist that allowed arbitrary shell execution on registry servers (demonstrated by two compromises), and a predictable reset token plus archive extraction symlink bug in PEAR enabling admin takeover and web‑shell deployment via reset‑token brute force. Builds and tests working exploits on VMs, confirms fixes, and reports CVEs and patches; notes composer handles roughly 2 billion monthly downloads (~20% of PHP projects).
AI-written summary · about
chapters (11)
- 0:00Package manager compromise
- 3:58Package server risks
- 10:19Command injection on Packagist
- 17:24Packagist fix and impact
- 23:00PEAR historical compromise
- 26:11PEAR password reset exploit
- 29:40PEAR attack demo
- 31:22Prevention and risk reduction
- 36:59Audit limits and security
- 38:42Client security and behavior
- 40:05Conclusion
related talks
59mThere's somebody in my package manager!
45mKnow Your Enemies: Live Exploit of a PHP Engine Security Breach
02h 18mWeb application security (Part 2)
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
43mPHP Security, Redefined
41mLive Hacking: Breaking into Your Web App
40mHow to hack a node app?