GHSA-6xch-2vxx-5pvr: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-6xch-2vxx-5pvr) affects eZ Platform's handling of executable access rules on Platform.sh (eZ Cloud). Discovered in 2019, this security issue impacts eZ Platform versions >= 2.5.0, < 2.5.4, >= 1.13.0, < 1.13.5.1, and >= 1.7.0, < 1.7.9.1. The vulnerability was assigned a moderate severity rating (GitHub Advisory).

The vulnerability stems from the recommended Apache/Nginx virtual host configuration for eZ Platform, which includes a rewrite rule for blocking access to executable files in the var directory. This rule fails to function properly when using eZ Platform Cloud on the Platform.sh cloud service. The issue specifically affects the platform's ability to properly enforce access restrictions on executable files (GitHub Advisory).

The primary impact of this vulnerability is that executable files in the var directory may become downloadable when deployed on Platform.sh. While these files cannot be executed unless specifically configured (which is strongly discouraged), the unauthorized download access represents a deviation from the platform's intended security model (GitHub Advisory).

The vulnerability affects all Platform.sh setups of eZ Platform. While the files cannot be executed without explicit configuration, they remain accessible for download, presenting a limited but notable security concern (GitHub Advisory).

The issue has been resolved through security updates distributed via Composer as ezsystems/ezplatform versions 1.7.9.1, 1.13.5.1, and 2.5.4. The fix adds a specific rule to the .platform.app.yaml configuration file that replicates the effect of the existing rewrite rule, preventing access to executable files with an 'Access Denied' response (GitHub Commit).