May 2, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Pegasus Spyware – Active IOCs
April 7, 2022Rewterz Threat Alert – APT-C-23 or AridViper Threat Group – Active IOCs
April 7, 2022Rewterz Threat Alert – Pegasus Spyware – Active IOCs
April 7, 2022Rewterz Threat Alert – APT-C-23 or AridViper Threat Group – Active IOCs
April 7, 2022
Severity
High
Analysis Summary
A 15-year-old flaw in PEAR PHP repository has been discovered by security researchers, which they believe contributed in Supply Chain Attacks. PEAR is a distribution system and framework for reusable PHP components.
“An attacker exploiting the first one could take over any developer account and publish malicious releases, while the second bug would allow the attacker to gain persistent access to the central PEAR server.” reads the post published by researchers.
The role of this software is to provide a bridge between the name of a package (e.g. Console_Getopt) and the absolute URL where to download it from (e.g. http://download.pear.php.net/package/Console_Getopt-1.4.3.tgz). Its compromise would allow changing this association and force package managers to download packages from unintended sources under the attacker’s control.
By using this exploit against existing developer or administrator accounts, attackers could publish new releases of existing packages after including malicious code in them. It would then be automatically downloaded and executed every time somebody fetches these packages from PEAR.
Impact
- Code Execution
Affected Vendors
PEAR
Affected Products
- mt_rand() PHP function
Remediation
For patches, refer to the vendor website:
https://github.com/pear/pearweb/commit/69f9531c2aca8866303b8b9efdd72365b6996f81
