fix(baseline): catch .htaccess php-enable persistence in the safety-net #8

imre.agent · 2026-07-22T10:58:18+02:00

imre.agent commented

2026-07-22 10:58:18 +02:00

Why

The build-baseline safety-net had a blind spot: a malicious .htaccess (or an inert .htaccess.json copy) that re-enables PHP execution on otherwise-static files bypassed all three existing filters. It has no <?php tag (so the php-in-templates filter misses it), and it is not named *.php.json / *.phtml (so the extension filter misses it), yet it can turn evil.jpg into executable PHP via AddType application/x-httpd-php .jpg or php_flag engine on. This is exactly the persistence class behind the 2026-07-14 docroot incident.

What

build-baseline.sh gains a fourth safety-net pass (d): it scans the assembled out/ for .htaccess and .htaccess.* files whose content matches AddType/AddHandler mapping PHP onto a non-.php extension, or php_flag engine on, and removes them from the baseline output. This keeps the deploy source-of-truth (and therefore the HIDS known-good reference) free of latent PHP-enable persistence.

Also in this change:

git rm of the one existing offender in the tree: deployed/helix3/templates/shaper_helix3/.htaccess.json.
malware-iocs.paths appended so the same path is caught as an IOC even if reintroduced upstream.

Verification

Re-ran the build; out/ no longer contains any PHP-enabling .htaccess*. The diff against the previously deployed state is limited to the removed offender — no legitimate template .htaccess was touched (the removed one is an inert .json copy, not the live Apache-read .htaccess).

## Why The build-baseline safety-net had a blind spot: a malicious `.htaccess` (or an inert `.htaccess.json` copy) that re-enables PHP execution on otherwise-static files bypassed all three existing filters. It has no `<?php` tag (so the php-in-templates filter misses it), and it is not named `*.php.json` / `*.phtml` (so the extension filter misses it), yet it can turn `evil.jpg` into executable PHP via `AddType application/x-httpd-php .jpg` or `php_flag engine on`. This is exactly the persistence class behind the 2026-07-14 docroot incident. ## What `build-baseline.sh` gains a fourth safety-net pass (d): it scans the assembled `out/` for `.htaccess` and `.htaccess.*` files whose content matches `AddType`/`AddHandler` mapping PHP onto a non-`.php` extension, or `php_flag engine on`, and removes them from the baseline output. This keeps the deploy source-of-truth (and therefore the HIDS known-good reference) free of latent PHP-enable persistence. Also in this change: - `git rm` of the one existing offender in the tree: `deployed/helix3/templates/shaper_helix3/.htaccess.json`. - `malware-iocs.paths` appended so the same path is caught as an IOC even if reintroduced upstream. ## Verification Re-ran the build; `out/` no longer contains any PHP-enabling `.htaccess*`. The diff against the previously deployed state is limited to the removed offender — no legitimate template `.htaccess` was touched (the removed one is an inert `.json` copy, not the live Apache-read `.htaccess`).

imre.agent added 1 commit 2026-07-22 10:58:18 +02:00

fix(baseline): catch .htaccess php-enable persistence in safety-net ca4d61d6c0

The malware safety-net missed .htaccess/.htaccess.json droppers that
enable PHP on non-.php extensions (AddType/AddHandler
application/x-httpd-php .json, php_flag engine on): they carry no
<?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped
them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json)
had entered the source repo and was built into the baseline (B:match),
blinding the detector against itself.

Add safety-net section (d) mirroring the malware_htaccess_php_enable
YARA rule (illusion/hids#183), remove the file from the source tree,
and add its path to malware-iocs.paths.

Ref: cadline/infra#180

imre merged commit 24f8e95c92 into main

2026-07-23 07:24:48 +02:00

imre referenced this issue from a commit

2026-07-23 07:24:49 +02:00

Merge pull request 'fix(baseline): catch .htaccess php-enable persistence in the safety-net' (#8) from fix/htaccess-safety-net into main

Sign in to join this conversation.

No reviewers

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cadline_web/www_archline_hu#8