Forums upgraded due to PHP2Shell

[loftar]

So in case anyone missed it despite the media talking about it nonstop for the last couple of days, there were recently two quite serious vulnerabilities in PHP disclosed, collectively called PHP2Shell, and needing urgent upgrades. For Haven's part, we only use PHP for the forums (being phpBB), but being that PHP2Shell allowed for pretty arbitrary remote code execution, that didn't mean I could not patch them. Now, the choice of phpBB being a bit of a regret on my part, I haven't bothered to upgrade it beyond phpBB 3.0, since that would have required me to rewrite all of my local modifications to them, which is primarily the (fantastic, award-winning) theme that you see before your eyes; however, running phpBB 3.0 has also meant that I have needed to stay on a pretty ancient version of PHP as well (version 5.6), which is ancient enough to not have received any of the security patches.

Nevertheless, having had to upgrade to PHP 8 to fix PHP2Shell, I was left with no other choice but to upgrade the forums as well, so we're now running the latest version of phpBB (3.3.19). I will say that another part of the reason why I haven't really bothered to upgrade phpBB earlier is that it doesn't really seem to have a whole lot of functional upgrades which have enticed me to do so, but that doesn't mean there are none whatsoever. Most noteworthy is perhaps the adoption of a responsive style-sheet, so the forums should now work well on smartphone screen sizes. It is apparently also possible to include a link to the original post in quote blocks. Other than that, I'm also still exploring it, so perhaps we'll find something else useful with it!

Some might also wonder if anything happened with PHP2Shell to compromise the server. I've been looking into it, and to the best of my knowledge, no such thing happened. Judging from the logs, there were attempts (probably automated ones), but they did not seem to succeed. I think I was somewhat protected by having run PHP in FastCGI mode with multiple worker processes, and PHP2Shell seemingly needing to hit the same process with two separate requests in a row seems to have been frustrated by that, since consecutive requests would not be accepted by the same worker process in this mode. There were also no core-dumps, no error messages, non non-2xx/-4xx responses in the logs or anything. Who knows, perhaps a sophisticated attacker has root-kitted the server so deeply and covered all their tracks well enough that I can't tell, but at least I indeed can't tell.

The upgrade job having been somewhat rushed, please tell me if you find anything awry!

[kalkkar]

always a few bad apples to ruin everything. hope things work out and make sure to check your stuff for any nasty stuff like injections or crypto bs- unsure if this is doable but i couldnt find many other reasons for people to even do this massive attack without any gain - alot of other servies like pokemon and some other mobile games were taken down to emergancy maintence for a full day because of it as well

[loftar]

always a few bad apples to ruin everything

To be fair, while it's a lot of work for a lot of people right now, I think it's better that 0-days are publicly known instead of being kept secret by the actual bad apples. :)

[losexd]

themed hat to celebrate the forum upgrade when

[kalkkar]

always a few bad apples to ruin everything

To be fair, while it's a lot of work for a lot of people right now, I think it's better that 0-days are publicly known instead of being kept secret by the actual bad apples.

the very exploiters you fight on a daily basis :/

[IsThisRad]

view active topics... why are you hiding from me

[loftar]

view active topics... why are you hiding from me

Yeah, that was bothering me too. Might look into it.

[IsThisRad]

I'll buy $30 worth of hats if you fix. Will send proof and everything. Credit card info and all

[IsThisRad]

Side note, I think the message body text on this version may be just a tiny bit too gray. The current lack of contrast against the tan is a little eye-strainy I think. This appears to be only for messages you've read before

[loftar]

Side note, I think the message body text on this version may be just a tiny bit too gray. The current lack of contrast against the tan is a little eye-strainy I think. This appears to be only for messages you've read before

Yeah, I just fixed that. Note that you may need to force-reload (Ctrl+F5) to get the stylesheets refreshed.