The presentation discusses the vulnerability of PHP stream wrappers and the potential for attackers to exploit them to gain control of data. The speaker focuses on the far stream wrapper and the far archive file format, and provides examples of how attackers can use this vulnerability to execute arbitrary code.
- PHP stream wrappers are a feature that can cause complex functionality to kick in from any file operation
- The far stream wrapper is a type of archive file format that can be exploited by attackers to execute arbitrary code
- The speaker provides examples of how attackers can use far planting to get a far archive onto a target and use PHP GGC to encapsulate payloads in the far file format
- Real-world case studies are presented to illustrate the potential impact of this vulnerability
- The speaker briefly discusses how to defend against this issue
The speaker provides an example of how this vulnerability can be exploited in WordPress through a legacy functionality for dealing with thumbnails. By partially controlling the value of a variable called thumb file, attackers can execute arbitrary code by triggering a function defined by a property of an array iterator class. Despite the fact that the system being attacked is Linux-based, attackers can set the value of the variable to look like a Windows path in order to exploit this vulnerability.