Snuffleupagus : Security Module For Php7 And Php8 – Killing Bugclasses And Virtual-Patching The Rest

Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire bug classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities and audit suspicious behaviours without having to touch the PHP code.

Key Features

• No noticeable performance impact
• Powerful yet simple to write virtual-patching rules
• Killing several classes of vulnerabilities
  • Unserialize-based code execution
  • mail-based code execution
  • Cookie-stealing XSS
  • File-upload based code execution
  • Weak PRNG
  • XXE
• Several hardening features
  • Automatic secure and samesite flag for cookies
  • Bundled set of rules to detect post-compromissions behaviours
  • Global strict mode and type-juggling prevention
  • Whitelisting of stream wrappers
  • Preventing writeable files execution
  • Whitelist/blacklist for eval
  • Enforcing TLS certificate validation when using curl
  • Request dumping capability
• A relatively sane code base:
  • A comprehensive test suite close to 100% coverage
  • Every commit is tested on several distributions
  • An clang-format-enforced code style
  • A comprehensive documentation
  • Usage of coverity

Download

We’ve got a download page, where you can find packages for your distribution, but you can of course just git clone this repo, or check the releases on github.

Examples

We’re providing various example rules, that are looking like this:

#Harden the chmod function
sp.disable_function.function(“chmod”).param(“mode”).value_r(“^[0-9]{2}[67]$”).drop();
#Mitigate command injection in system
sp.disable_function.function(“system”).param(“command”).value_r(“[$|;&`\n]”).drop();

Upon violation of a rule, you should see lines like this in your logs:

[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function ‘strpos’ matched a rule.