In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation.
PoC
id: CVE-2019-11043
info:
name: PHP-FPM Path Info Buffer Underflow - Remote Code Execution
author: Prasath from Securin Labs (https://securin.io)
severity: critical
description: |
In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation.
remediation: |
Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later. As mitigation, remove the fastcgi_split_path_info directive or ensure it cannot match an empty PATH_INFO.
reference:
- https://bugs.php.net/bug.php?id=78599
- https://github.com/neex/phuip-fpizdam
- https://www.nginx.com/blog/nginx-php-fastcgi-process-manager/
- https://security.netapp.com/advisory/ntap-20191031-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11043
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2019-11043
cwe-id: CWE-119
epss-score: 0.9978
epss-percentile: 0.99955
cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: php
product: php
shodan-query: title:"PHP" port:80,443
fofa-query: app="PHP"
tags: cve,cve2019,php,php-fpm,nginx,rce,fastcgi,kev,vkev
http:
- raw:
- |
GET /index.php/%0a HTTP/1.1
Host: {{Hostname}}
- |
GET /index.php/%0atest HTTP/1.1
Host: {{Hostname}}
extractors:
- type: regex
name: php_version
part: header
group: 1
regex:
- "(?i)X-Powered-By:\\s*PHP/([0-9]+\\.[0-9]+\\.[0-9]+)"
internal: true
matchers-condition: and
matchers:
- type: status
part: header
status:
- 200
condition: and
- type: word
part: header
words:
- "X-Powered-By: PHP"
- "x-powered-by: php"
condition: or
case-insensitive: true
- type: regex
part: header
regex:
- "(?i)X-Powered-By:\\s*PHP/(7\\.(0|1|2|3)\\.[0-9]+|5\\.[0-9]+\\.[0-9]+)"
- type: dsl
dsl:
- |
compare_versions(php_version, ">= 7.0.0", "< 7.1.33") ||
compare_versions(php_version, ">= 7.2.0", "< 7.2.24") ||
compare_versions(php_version, ">= 7.3.0", "< 7.3.11")
# digest: 4a0a00473045022015ddf76be8adeb2100969900f9f82c93c0f4f35d34de846a5bcb18d336a5d53102210082fb018856eeae3ca3ad27f82a5193f3d4a81b7dfbffbfb24a47e0e16c85e3de:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.