CVE-2019-11043 exposes Web servers using nginx and PHP
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11043 | Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score. Do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| masson the order of millions of sites/servers plausibly exposed (PHP runs on a large majority of websites and nginx+PHP-FPM is among the most common production… |
Full article330 words · extracted from securityaffairs.com · click to collapse
asty PHP7 remote code execution bug exploited in the wild
Experts warn of a remote code execution vulnerability in PHP7, tracked as CVE-2019-11043, has been exploited in attacks in the wild.
A remote code execution vulnerability in PHP7, tracked as CVE-2019-11043, has been exploited in attacks in the wild.
On October 22, the security expert Omar Ganiev announced via Twitter the availability of a “freshly patched” remote code execution vulnerability in PHP-FPM, the FastCGI Process Manager (FPM) for PHP.
The researchers also shared a link to the PoC code published on the GitHub repository.
The CVE-2019-11043 flaw doesn’t request specific skills to be exploited and take over servers, it is an env_path_info underflow flaw in PHP-FPM’s fpm_main.c. Thin means that the issue only impacts NGINX servers with PHP-FPM enabled.
The flaw was first reported to the PHP bug-tracker by security expert Emil Lerner on September 26, 2019 that also credited the researcher Andrew Danau for the issue. Danau discovered the vulnerability during a Capture The Flag competition in September 2019.
Lerner explained that the vulnerability could be exploited to gain remote code execution under certain configurations where a web server is using nginx and PHP-FPM,
“The PoC script included in the GitHub repository can query a target web server to identify whether or not it is vulnerable by sending specially crafted requests.” reads the analysis published by Tenable. “Once a vulnerable target has been identified, attackers can send specially crafted requests by appending “?a=” in the URL to a vulnerable web server.”
On October 24, PHP maintainers released PHP 7.3.11 (current stable) and PHP 7.2.24 (old stable) that addressed the CVE-2019-11043 vulnerability. Administrators using nginx with PHP-FPM urge to upgrade their installs as soon as possible.
The maintainers also suggested a workaround that consists in either by including the try_files directive or using an if statement, such as if (-f $uri).
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CVE-2019-11043, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/92997/hacking/cve-2019-11043-php7-flaw.html