Blocking multipart uploads with Caddy

Help
1

Please forgive the break from the usual post format requirements.

There’s a very serious PHP exploit about to do the rounds, and mitigation is merely “to buy time”. The only solution is PHP upgrades, but they’re not even out yet.

Long and short; with Caddy, how do we refuse every request whose Content-Type header contains “multipart” before it reaches PHP?

For Apache it’s this…

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Thanks for your time.

2

You need to add this to all your hosts:

@mitigate_php2shell header Content-Type multipart/*
respond @mitigate_php2shell "Multipart requests blocked" 403 {
    close
}
3

Thanks.

The panic is going to be long running, but oh boy… what a day/week.