Packistry aceita tokens de acesso expirados

An attacker possessing an expired deploy token with the correct ability could leverage this vulnerability to gain unauthorized access to Packistry's repository APIs. This could allow them to download malicious packages, modify package metadata, or even inject their own packages into the repository, potentially impacting downstream applications that rely on Packistry for PHP package management. The blast radius extends to any applications or systems that consume packages from a compromised Packistry instance. While the token is expired, the attacker still has access, which is a significant risk.

Organizations using Packistry for self-hosting PHP packages, particularly those with legacy deployment pipelines or less stringent token management practices, are at risk. Shared hosting environments where multiple users share a Packistry instance are also particularly vulnerable, as a compromised token from one user could potentially impact others.

• php: Examine Packistry logs for requests originating from tokens with unusually long durations or timestamps that suggest they may be expired.

grep 'token_expiration' /path/to/packistry/logs/access.log

1. 2026-02-26Disclosure

   disclosure

1. Reservado2026-02-25
2. Publicada2026-02-26
3. EPSS atualizado2026-03-23

The primary mitigation is to upgrade Packistry to version 0.13.0 or later, which includes the necessary expiration check. If upgrading is not immediately feasible, consider implementing stricter token management policies, such as shorter token expiration times and regular token rotation. While not a direct fix, implementing a Web Application Firewall (WAF) with rules to detect and block requests from potentially expired tokens could provide an additional layer of defense. Regularly review and audit deploy token usage to identify and revoke any suspicious or unused tokens.