php_session_upload_progress_uaf.yar

/*
    php_session_upload_progress_uaf.yar

    Heuristic detection for exploitation of the PHP session.upload_progress
    heap use-after-free disclosed 2026-10 (PHP security release 2026-10-21,
    two CVSS 9.2 issues; third-party tracking CVE-2026-109618 / CVE-2026-109619,
    UNVERIFIED pending the official php.net advisory).

    VALIDATED 2026-10-21 (lab, Proxmox VM 3013, Debian 13 / nginx / PHP 8.4.26):
      - 0 false positives on REAL benign session.upload_progress upload traffic
        (captured nginx access.log + real multipart body, 1 file part).
      - 3/3 true positives on synthetic exploit artifacts (toolkit file,
        grooming body with 40 parts, FPM SIGSEGV log line).
      - Fixed during validation: rule 3 crash marker was "child exited on
        signal 11" which NEVER matches real FPM logs ("child <PID> exited on
        signal 11"); corrected to "exited on signal 11" + "SIGSEGV".
      Still NOT validated against a real exploit (none run) or the official patch.

    STATUS: pre-advisory heuristics, written from publicly-described behavior
    only. No official root cause or patch existed at authoring time. RE-TUNE
    against the official advisory + patch diff once published (14:00 UTC
    2026-10-21), and validate against your own benign upload traffic before
    enforcing — the legitimate session.upload_progress feature uses the SAME
    field name, so rule 2/3 WILL false-positive on normal uploads without the
    grooming/racing qualifiers.

    Scope:
      rule 1  exploit toolkit / PoC artifacts on disk
      rule 2  multipart request body showing heap-grooming abuse of the handler
      rule 3  captured HTTP log line pattern (access/proxy/WAF text logs)
*/

import "math"

rule PHP_SessionUploadProgress_UAF_Toolkit
{
    meta:
        description = "Files of an exploit toolkit targeting the PHP session.upload_progress UAF"
        author = "cirsec"
        date = "2026-10-21"
        reference = "https://www.php.net/archive/2026.php (advance notice 2026-10-20)"
        severity = "high"
        confidence = "medium"
    strings:
        // the handler field the exploit must reference (anchor)
        $feat2 = "PHP_SESSION_UPLOAD_PROGRESS" ascii
        // self-assigned (unverified) CVE tags seen in third-party PoC
        $cve1 = "CVE-2026-109618" ascii nocase
        $cve2 = "CVE-2026-109619" ascii nocase
        // heap-manipulation / race vocabulary typical of a UAF weaponization
        $uaf1 = "use-after-free" ascii nocase
        $uaf2 = "use after free" ascii nocase
        $groom1 = "heap spray" ascii nocase
        $groom2 = "heap groom" ascii nocase
        $groom3 = "defragment" ascii nocase
        $race1 = "race" ascii nocase
        $tgt1 = "8.4.4" ascii
        $tgt2 = "8.2.34" ascii
    condition:
        filesize < 5MB
        and $feat2
        and (
            any of ($cve*)
            or (any of ($uaf*) and any of ($groom*))
            or (any of ($groom*) and $race1 and any of ($tgt*))
        )
}

rule PHP_SessionUploadProgress_UAF_MultipartAbuse
{
    meta:
        description = "Captured multipart/form-data body abusing session.upload_progress for heap grooming (UAF trigger)"
        author = "cirsec"
        date = "2026-10-21"
        severity = "high"
        confidence = "low"   // legitimate uploads share the field name; needs the grooming qualifier
        note = "Run over captured request bodies (e.g. mod_security SecAuditLog, tcpdump -A, pcap text export), not live traffic."
    strings:
        $mp = "Content-Type: multipart/form-data" ascii nocase
        // the progress trigger field, which MUST be first in the body to arm the handler
        $trigger = "name=\"PHP_SESSION_UPLOAD_PROGRESS" ascii
        // grooming indicators: many filename parts / repeated progress fields in one body
        $part = "Content-Disposition: form-data;" ascii
        $fn = "filename=\"" ascii
    condition:
        $mp and $trigger
        // abnormal fan-out of parts in a single body = grooming, not a normal 1-2 file upload
        and ( #part > 24 or #fn > 24 )
}

rule PHP_SessionUploadProgress_UAF_LogPattern
{
    meta:
        description = "Access/WAF text-log evidence of repeated POSTs driving session.upload_progress (possible UAF racing)"
        author = "cirsec"
        date = "2026-10-21"
        severity = "medium"
        confidence = "low"
        note = "Heuristic over text logs; correlate with 5xx spikes / FPM worker crashes before acting."
    strings:
        $post = "POST " ascii
        $ct = "multipart/form-data" ascii nocase
        $field = "PHP_SESSION_UPLOAD_PROGRESS" ascii
        // worker-death markers that accompany a UAF being hit.
        // NB: FPM logs carry the PID ("child 2402 exited on signal 11"), so the
        // marker must NOT include "child" — match the stable tail only.
        $crash1 = "exited on signal 11" ascii nocase
        $crash2 = "SIGSEGV" ascii           // FPM/kernel segfault report
        $crash3 = "segfault at" ascii nocase // kernel dmesg line
        $crash4 = "AH01067" ascii           // Apache: Failed to read FastCGI header
        $crash5 = "AH01075" ascii           // Apache: Error dispatching to backend
        $crash6 = "Connection reset by peer" ascii nocase
    condition:
        $post and $ct and $field and any of ($crash*)
}