Debian DSA-6565-1: SPIP Unauthenticated Remote Code Execution — Patch, Detection, and Hardening Guide

---
title: Web Server Process Spawning Shell or System Utility (SPIP Host)
id: 9f2c4a71-3b8e-4d5a-91f6-2c7e8a1b3d4f
status: experimental
description: Detects the www-data/wwwrun web service account spawning shells or common post-exploitation utilities, consistent with unauthenticated RCE exploitation of a PHP CMS such as SPIP (Debian DSA-6565-1).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6565-1-spip
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_user:
    User|contains:
      - 'www-data'
      - 'wwwrun'
      - 'apache'
      - 'nginx'
  selection_image:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/base64'
  condition: selection_user and selection_image
falsepositives:
  - Rare; some CMS plugins invoke system utilities for image processing (e.g., via exec). Baseline and exclude known plugin paths.
level: high
---
title: Webshell or PHP File Dropped in SPIP Writable Directories
id: 3e7b1d92-6a4f-4c28-b5d1-8f9a2e6c4b7d
status: experimental
description: Detects creation of PHP files inside SPIP's writable upload and temp directories (IMG/, tmp/, local/), a strong indicator of webshell deployment following CMS exploitation.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6565-1-spip
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/spip/IMG/'
      - '/spip/tmp/'
      - '/spip/local/'
      - '/sites/*/IMG/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate SPIP operations rarely write .php files into IMG/ or tmp/; investigate any hit. Admin uploads of PHP files (should be blocked by policy) may trigger.
level: critical
---
title: Suspicious Outbound Connection from PHP-FPM or Apache Worker
id: 5c1a8f43-2d9b-4e67-a3f5-7b2c9d1e4a6f
status: experimental
description: Detects PHP-FPM or Apache worker processes initiating outbound network connections, consistent with reverse shell or payload retrieval activity after CMS code execution.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6565-1-spip
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'php-fpm'
      - '/apache2'
      - '/httpd'
    Initiated: 'true'
  filter_common:
    DestinationPort:
      - 80
      - 443
  condition: selection and not filter_common
falsepositives:
  - Outbound HTTP(S) from the CMS for updates or RSS fetching is expected; non-80/443 destinations are the anomaly of interest.
level: high

// Hunt: SPIP/PHP CMS post-exploitation — web account spawning shells or downloaders
// Ingestion: Syslog (Linux auditd/execve) or DeviceProcessEvents via MDE for Linux
let WebUsers = dynamic(["www-data", "wwwrun", "apache", "nginx"]);
let SuspiciousBins = dynamic(["/bin/sh", "/bin/bash", "/bin/dash", "/usr/bin/curl", "/usr/bin/wget", "/usr/bin/nc", "/bin/nc", "/usr/bin/python3", "/usr/bin/perl", "/usr/bin/base64"]);
union isfuzzy=true
    (Syslog
     | where TimeGenerated > ago(14d)
     | where SyslogMessage has_any (SuspiciousBins)
     | where SyslogMessage has_any (WebUsers)
     | extend Host = Computer, Detail = SyslogMessage
     | project TimeGenerated, Host, Detail, Source = "Syslog"),
    (DeviceProcessEvents
     | where TimeGenerated > ago(14d)
     | where AccountName in~ (WebUsers)
     | where FileName has_any ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "perl", "base64")
     | extend Detail = strcat(ProcessCommandLine)
     | project TimeGenerated, Host = DeviceName, Detail, InitiatingProcessCommandLine, Source = "MDE")
| order by TimeGenerated desc;

// Hunt: PHP file writes into SPIP writable directories (webshell staging)
// Requires FileIntegrityMonitoring (FIM) data via Syslog/CommonSecurityLog or MDE DeviceFileEvents
union isfuzzy=true
    (DeviceFileEvents
     | where TimeGenerated > ago(14d)
     | where FolderPath has_any ("/IMG/", "/tmp/", "/local/", "/ecrire/")
     | where FolderPath has "spip"
     | where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar"
     | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine, Source = "MDE"),
    (CommonSecurityLog
     | where TimeGenerated > ago(14d)
     | where Message has "spip" and Message has_any (".php", ".phtml", ".phar")
     | where Message has_any ("IMG", "tmp", "local")
     | project TimeGenerated, DeviceName = Computer, Message, Source = "CEF/FIM")
| order by TimeGenerated desc;

-- Artifact: SPIP_PostExploit_Triage
-- 1) Processes running under web service accounts (potential shells spawned from www-data)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|wwwrun|apache|nginx'
  AND (Name =~ '(?i)(sh|bash|dash|curl|wget|nc|ncat|python|perl)'
       OR CommandLine =~ '(?i)(/dev/tcp|base64 -d|eval|reverse|shell)')

-- 2) Recently created/modified PHP files in SPIP writable directories (webshell hunt)
LET spip_dirs <= ['/var/www/**/IMG/', '/var/www/**/tmp/', '/var/www/**/local/', '/srv/**/spip/**/IMG/']
SELECT FullPath, Size, Mtime, Ctime, Btime
FROM glob(globs=spip_dirs, accessor='file')
WHERE FullPath =~ '(?i)\.ph(p|html|ar)$'
  AND Mtime > (now() - 1209600)  -- last 14 days
ORDER BY Mtime DESC

#!/usr/bin/env bash
# DSA-6565-1 SPIP patch & verification script — Debian 13 (trixie)
set -euo pipefail

FIXED_VERSION="4.4.28+dfsg-0+deb13u1"

echo "[+] Current SPIP package version:"
dpkg -l spip 2>/dev/null || { echo "[-] SPIP not installed on this host."; exit 0; }

INSTALLED=$(dpkg-query -W -f='${Version}' spip 2>/dev/null || echo "none")
echo "[+] Installed: ${INSTALLED} | Required: ${FIXED_VERSION} or later"

echo "[+] Updating package index and applying SPIP security update..."
apt-get update -y
apt-get install --only-upgrade -y spip

NEW_VERSION=$(dpkg-query -W -f='${Version}' spip)
echo "[+] Post-patch version: ${NEW_VERSION}"

if dpkg --compare-versions "$NEW_VERSION" ge "$FIXED_VERSION"; then
  echo "[PASS] SPIP is patched against DSA-6565-1."
else
  echo "[FAIL] SPIP remains below the fixed version. Investigate apt pinning/holds."
  apt-mark showhold | grep -i spip && echo "[!] Package is on hold."
  exit 1
fi

# Post-patch hygiene checks
echo "[+] Checking for unexpected PHP files in SPIP writable directories (last 14 days):"
find /var/www -path '*/IMG/*' -name '*.php' -mtime -14 2>/dev/null
find /var/www -path '*/tmp/*' -name '*.php' -mtime -14 2>/dev/null
find /var/www -path '*/local/*' -name '*.php' -mtime -14 2>/dev/null

echo "[+] Checking for shells spawned by www-data in auth/syslog (last 24h):"
grep -E 'www-data.*(sh|bash|nc |curl |wget )' /var/log/syslog 2>/dev/null | tail -20 || echo "    none found in syslog"

echo "[+] Restarting web services to ensure patched code is loaded:"
systemctl restart php*-fpm.service 2>/dev/null || true
systemctl restart apache2 2>/dev/null || systemctl restart nginx 2>/dev/null || true

echo "[+] Done. Review findings above; any PHP file in IMG/tmp/local warrants IR escalation."