Snuffleupagus is a PHP 7+ module designed to
drastically raise the cost of attacks against websites, by killing entire bug
classes. It also provides a powerful virtual-patching system, allowing
administrator to fix specific vulnerabilities and audit suspicious behaviours
without having to touch the PHP code.
Key Features
- No noticeable performance impact
- Powerful yet simple to write virtual-patching rules
- Killing several classes of vulnerabilities
- Unserialize-based code execution
mail-based code execution- Cookie-stealing XSS
- File-upload based code execution
- Weak PRNG
- XXE
- Several hardening features
- Automatic
secureandsamesiteflag for cookies - Bundled set of rules to detect post-compromissions behaviours
- Global strict mode and type-juggling prevention
- Whitelisting of stream wrappers
- Preventing writeable files execution
- Whitelist/blacklist for
eval - Enforcing TLS certificate validation when using curl
- Request dumping capability
- Automatic
- A relatively sane code base:
- A comprehensive test suite close to 100% coverage
- Every commit is tested on several distributions
- An
clang-format-enforced code style - A comprehensive documentation
- Usage of coverity
Download
We've got a download
page, where you can find
packages for your distribution, but you can of course just git clone this
repo, or check the releases on github.
Examples
We're providing various example rules,
that are looking like this:
# Harden the `chmod` function
sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop();
# Mitigate command injection in `system`
sp.disable_function.function("system").param("command").value_r("[$, ;&`\\n]").drop();
Upon violation of a rule, you should see lines like this in your logs:
[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule.
Documentation
We've got a comprehensive website with
all the documentation that you could possibly wish for. You can of course
build it yourself.
Thanks
Many thanks to the Suhosin project for being a huge
source of inspiration, and to all our
contributors.