Debian DSA-6456-1: Critical Unauthenticated RCE in SPIP CMS — Patching and Detection Guide for Debian 13

---
title: Web Server Spawning Shell or Downloader on Linux (SPIP RCE Post-Exploitation)
id: 3f8a1b24-6c5d-4e7f-9a2b-1c3d5e7f9a0b
status: experimental
description: Detects the web server or PHP-FPM worker process spawning a shell, downloader, or interpreter — the canonical post-exploitation behavior of unauthenticated RCE in PHP applications such as SPIP (DSA-6456-1).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6456-1-spip
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/php-fpm'
      - '/nginx'
      - '/lighttpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/chmod'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate CMS plugins invoking system utilities (rare on SPIP; investigate per-host)
  - Health-check or monitoring scripts executed via cron under the web user (those run under cron, not the web server parent)
level: high
---
title: PHP File Created in SPIP Writable or Web-Accessible Directories
id: 8c2e4f61-3a7b-4d9c-b5e1-2f4a6c8e0b1d
status: experimental
description: Detects creation of PHP files in SPIP's writable directories (IMG, tmp, local, squelettes) — a strong web shell indicator following exploitation of unauthenticated RCE such as DSA-6456-1.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6456-1-spip
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
  service: auditd
detection:
  selection:
    TargetFilename|contains:
      - '/IMG/'
      - '/tmp/'
      - '/local/'
      - '/squelettes/'
      - '/sites/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php7'
      - '.php8'
  filter_legit_update:
    Image|endswith:
      - '/dpkg'
      - '/apt'
  condition: selection and not filter_legit_update
falsepositives:
  - SPIP core or plugin updates deployed manually outside apt (validate against change windows)
  - Developers authoring custom squelette templates (these are .html, not .php, in SPIP — PHP here is suspicious)
level: critical
---
title: Suspicious HTTP Request to SPIP Application Endpoints
id: 5d7a9c13-8e2f-4b6a-a1c9-7d3e5f0a2b4c
status: experimental
description: Detects inbound requests to SPIP's administrative/action endpoints from external sources with encoded or oversized payloads — consistent with exploitation attempts against unauthenticated code execution flaws (DSA-6456-1).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6456-1-spip
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
  service: apache
detection:
  selection_uri:
    cs-uri|contains:
      - 'spip.php'
      - '/ecrire/'
      - '?action='
      - 'exec='
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_payload:
    cs-uri-query|contains:
      - '%00'
      - 'eval('
      - 'base64_decode'
      - 'system('
      - 'shell_exec'
      - 'passthru'
      - '${'
      - 'file_put_contents'
  condition: selection_uri and (selection_method or selection_payload)
falsepositives:
  - Authenticated SPIP editors using the ecrire/ back office (filter on known admin source IPs)
  - Legitimate plugin action handlers (baseline per site; alert on net-new URI patterns)
level: medium

// Hunt 1: Web server / PHP-FPM spawning shells or downloaders (post-exploitation of SPIP RCE)
// Requires auditd process events ingested via Syslog, or Defender for Endpoint on any Linux hosts
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName has_any ("apache2", "php-fpm", "nginx", "lighttpd")
| where FileName has_any ("sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "base64", "php")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: Anomalous requests to SPIP endpoints via ingested Apache/Nginx logs (Syslog/CEF)
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("spip.php", "/ecrire/", "?action=", "exec=")
| where SyslogMessage has_any ("POST", "PUT")
   or SyslogMessage has_any ("%00", "eval(", "base64_decode", "system(", "shell_exec",
                              "passthru", "file_put_contents", "${")
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
            by SourceIP, Computer, bin(TimeGenerated, 1h)
| order by RequestCount desc;

// Hunt 3: PHP files written under SPIP writable directories (web shell staging)
// Requires file auditing (auditd -w on web root) ingested as Syslog
Syslog
| where TimeGenerated > ago(24h)
| where Facility == "local7" or SyslogMessage has "type=SYSCALL" or SyslogMessage has "name="
| where SyslogMessage matches regex @"(IMG|tmp|local|squelettes)/[^\"']*\.(php|phtml|phar)"
| extend DroppedFile = extract(@"name=\"([^\"]+\.(php|phtml|phar))\"", 1, SyslogMessage)
| where isnotempty(DroppedFile)
| project TimeGenerated, Computer, DroppedFile, SyslogMessage
| order by TimeGenerated desc;

-- Hunt: SPIP RCE post-exploitation artifacts on Debian web hosts (DSA-6456-1)
-- Part A: Processes running as www-data that should never be interactive
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx'
  AND Name =~ '^(sh|bash|dash|curl|wget|python3?|perl|nc|ncat|socat|php)$'

-- Part B: Recently modified PHP files in SPIP writable directories
-- Adjust the web root glob to match your deployment
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/var/www/**/IMG/**/*.php',
                 '/var/www/**/tmp/**/*.php',
                 '/var/www/**/local/**/*.php',
                 '/var/www/**/squelettes/**/*.php',
                 '/srv/**/IMG/**/*.php'])
WHERE Mtime > (now() - 86400 * 7)
ORDER BY Mtime DESC

#!/usr/bin/env bash
# DSA-6456-1 SPIP unauthenticated RCE — patch verification and triage (Debian 13)
set -euo pipefail

FIXED_VERSION="4.4.21+dfsg-0+deb13u1"

echo "=== [1] Current SPIP package status ==="
if dpkg -l spip 2>/dev/null | grep -q '^ii'; then
  INSTALLED=$(dpkg-query -W -f='${Version}' spip)
  echo "Installed spip version: ${INSTALLED}"
  if dpkg --compare-versions "${INSTALLED}" lt "${FIXED_VERSION}"; then
    echo "[!] VULNERABLE — version predates ${FIXED_VERSION}. Updating now..."
    apt-get update
    apt-get install --only-upgrade -y spip
    NEW=$(dpkg-query -W -f='${Version}' spip)
    echo "[+] Updated to: ${NEW}"
    dpkg --compare-versions "${NEW}" ge "${FIXED_VERSION}" \
      && echo "[+] PASS: patched to fixed version" \
      || { echo "[-] FAIL: still below fixed version"; exit 1; }
  else
    echo "[+] PASS: already at or above fixed version ${FIXED_VERSION}"
  fi
else
  echo "[i] spip package not installed via apt."
  echo "[i] If SPIP was deployed manually, check the upstream version in ecrire/info or"
  echo "    config/version and update via spip_loader — apt will NOT cover manual installs."
fi

echo ""
echo "=== [2] Web server child process audit (live) ==="
WEB_USER_PROCS=$(ps -eo user,ppid,comm,args | awk '
  $1 ~ /^(www-data|apache|nginx)$/ &&
  $3 ~ /^(sh|bash|dash|curl|wget|python|python3|perl|nc|ncat|php)$/')
if [[ -n "${WEB_USER_PROCS}" ]]; then
  echo "[!] Suspicious processes running as the web user:"
  echo "${WEB_USER_PROCS}"
else
  echo "[+] No suspicious web-user child processes found"
fi

echo ""
echo "=== [3] Web shell sweep: PHP files modified in last 7 days under SPIP dirs ==="
find /var/www /srv -type d \( -name IMG -o -name tmp -o -name local -o -name squelettes \) 2>/dev/null | \
while read -r dir; do
  find "${dir}" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -7 2>/dev/null
done | sort -u || echo "[+] No recently modified PHP files in SPIP writable directories"

echo ""
echo "=== [4] Outbound connections from the web user ==="
ss -tnp 2>/dev/null | grep -E 'users:\(\("(curl|wget|nc|ncat|bash|sh|python)' || \
  echo "[+] No anomalous outbound connections from web-user tooling"

echo ""
echo "=== Triage complete. Review flagged items before returning the host to service. ==="