PHP-CGI vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-1823 | PHP-CGI Query String Parsing Flaw Enables Unauthenticated Remote Code Execution PHP, when the interpreter is exposed through the CGI (php-cgi) interface, mishandles query strings (CWE-20 improper input validation), allowing attackers to pass command-line switches such as -d and -s directly to the interpreter. A remote, unauthenticated attacker triggers the flaw by sending a crafted query string beginning with a dash (including URL-encoded forms) to any URL handled by php-cgi. Successful exploitation allows arbitrary code execution under the web server's privileges, as well as disclosure of script source code or phpinfo output, with no authentication required. Only deployments that invoke PHP via CGI/FastCGI (common in legacy shared hosting and bundled software stacks) are affected; PHP running as an Apache module or via PHP-FPM is not exposed. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25 with EPSS at 100%, indicating active in-the-wild exploitation; any ransomware association is not yet confirmed. Do: Upgrade PHP to at least 5.3.13/5.4.3 or, preferably, a currently supported PHP branch, and stop exposing the php-cgi binary directly by moving to mod_php or PHP-FPM. As an interim mitigation, block or rewrite requests whose query string begins with a dash (e.g., -d, -s, or URL-encoded dash characters) and review web server logs for such patterns to detect prior exploitation. | — | 100% | KEV |
| masshundreds of thousands of internet-exposed php-cgi endpoints (a subset of the tens of millions of PHP-powered websites) |
Full article340 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, May 8, 2012 15:44
You've probably heard about the PHP-CGI command-line parameter vulnerability (CVE-2012-1823) released last Thursday, especially if you're defending a PHP-based web application environment. While it makes use of a non-default configuration for exploitation, for users who choose to run PHP through a CGI wrapper, the implications are very important, including potential source code disclosure and remote code execution.
Since this bug is now being actively exploited in the wild, and has had a Metasploit module developed to exploit it, it's worth a note to Snort users explaining the nature of the vulnerability and the state of our coverage, so that IDS analysts can act appropriately on the issue.
At its core, the issue here is fairly simple. When PHP is run in CGI mode, certain arguments will not be escaped before being passed to the PHP binary, which then interprets them as command-line arguments. For example, "-s", will cause the PHP binary to return the source code of the script being run, and not the output of that script. A much more serious case comes when the "-d" flag is used in conjunction with "auto_prepend_file"; by specifying a remote file with PHP code, arbitrary command execution in the context of the PHP binary can be trivially achieved.
There are three signatures for this vulnerability:
- SID 22063, which covers the remote command execution case used by Metasploit and being exploited in the wild. This rule is enabled in the balanced and security policies by default.
- SID 22064, which looks for source code disclosure when files include a ".php" in their name. This rule is enabled in the balanced and security policies by default.
- SID 22097, which looks for source code disclosure against PHP files executed as directory indexes (i.e. http://www.vuln.com/own_me/). This rule is enabled in no policies by default due to performance considerations, but should be enabled manually by those who are protecting known-vulnerable installations. The VRT is actively monitoring for signs of other abuse cases or obfuscations, and will update rules as appropriate.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/php-cgi-vulnerability-exploits-in-wild/