Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an unauthenticated remote command execution in flyto-core. The root cause is the lack of an authentication check on the /mcp HTTP endpoint, specifically in the mcp_post function in src/core/api/routes/mcp.py. The patch db7f116b1d3c5dcf94aded00d14118f81f3e225e confirms this by adding dependencies=[Depends(require_auth)] to the @router.post("") and @router.delete("") decorators.
An attacker can send a specially crafted JSON-RPC request to the /mcp endpoint. The request calls the tools/call method with the execute_module name, targeting the sandbox.execute_shell module. The mcp_post function, being unauthenticated, accepts this request and passes it to the handle_jsonrpc_request function. This eventually leads to the execution of the sandbox.execute_shell module.
The sink of the vulnerability is a function within the sandbox.execute_shell module (in src/core/modules/atomic/sandbox/execute_shell.py), which takes the user-provided command and executes it via asyncio.create_subprocess_shell.
Therefore, the key vulnerable functions are the unauthenticated entry points mcp_post and mcp_delete, and the command execution sink within sandbox.execute_shell. A runtime profile during exploitation would show a call chain starting from mcp_post and ending in the execution of the shell command.
mcp_postsrc/core/api/routes/mcp.py
mcp_deletesrc/core/api/routes/mcp.py
sandbox.execute_shell.runsrc/core/modules/atomic/sandbox/execute_shell.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flyto-core | pip | >= 2.26.2, < 2.26.4 | 2.26.4 |