PHP RCE flaw actively exploited to pop NGINX servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11043 | Buffer Overflow in PHP-FPM Enables Unauthenticated RCE on nginx Stacks CVE-2019-11043 is a buffer overflow (CWE-120/CWE-787) in PHP's FastCGI Process Manager (PHP-FPM) affecting PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. In certain FPM configurations — commonly web servers such as nginx that split PATH_INFO via fastcgi_split_path_info without validating that the requested PHP script exists — an unauthenticated remote attacker can send a crafted request that makes PHP-FPM write past allocated buffers into the space reserved for FCGI protocol data. This corruption of the FastCGI protocol state allows the attacker to execute arbitrary code with the privileges of the PHP-FPM worker on the hosting web server. Anyone running a vulnerable PHP-FPM behind an affected configuration is exposed, including Linux distribution packages (Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, Red Hat Software Collections), Tenable.sc deployments, and QNAP NAS devices running vulnerable PHP. The flaw is being actively exploited in the wild — it is in CISA's KEV with known ransomware use (including campaigns such as NextCry targeting Nextcloud instances on Linux servers) — and a public proof-of-concept exploit exists, consistent with its 99.8% EPSS score. Do: Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later (or apply your distribution's/vendor's patched packages — CISA's KEV required action is to apply updates per vendor instructions; QNAP users should apply QNAP's released updates). As an interim mitigation, harden the nginx fastcgi_split_path_info configuration (prefix the regex with '^' and use try_files to confirm the script exists) or disable PATH_INFO where it is not needed. Prioritize internet-facing web servers, shared hosting, and QNAP/Nextcloud instances for patching and check them for compromise, given active ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| masson the order of millions of sites/servers plausibly exposed (PHP runs on a large majority of websites and nginx+PHP-FPM is among the most common production… |
Full article477 words · extracted from helpnetsecurity.com · click to collapse
A recently patched vulnerability (CVE-2019-11043) in PHP is being actively exploited by attackers to compromise NGINX web servers, threat intelligence firm Bad Packets has confirmed.
For a successful exploitation, target servers must have the PHP-FPM (FastCGI Process Manager) feature enabled, but that combination is not as uncommon as initially believed.
About CVE-2019-11043
The flaw was discovered by Wallarm researcher Andrew Danau during a Capture The Flag contest that took place in September 2019.
The PHP Development Team was notified about the vulnerability that same month and patched it in PHP versions 7.3.11, 7.2.24 and 7.1.33 (released last week).
A few days before that, PoC exploit code for the flaw – created by Danau’s fellow CTF players and researchers Emil Lerner and Omar Ganiev – was published on GitHub.
As noted by Lerner, it works only on PHP 7 and later (though others could find a way to adapt it to work on PHP versions 5 and later). It first queries a web server to see it’s vulnerable and, if it is, attackers can send specially crafted requests (with commands) to it:
CVE-2019-11043 i'm beat pic.twitter.com/CZCb9if65s
— ice (@ice43396118) October 24, 2019
Technical details about the buffer underflow bug can be found in Wallarm’s blog post as well as the bug entry in the PHP bug tracker.
The crucial thing is that, if certains preconditions are met, the flaw and the PoC could be used to achieve remote code execution on vulnerable servers.
Advice for admins
As noted before, only NGINX servers with PHP-FPM enabled are vulnerable. PHP-FPM is a feature that allows servers to execute scripts faster.
There are many NGNIX-based web servers and PHP 7-based websites out there: according to W3Techs, NGINX is used by 30.6% of all the websites whose web server they know. A third of all websites are using various versions of PHP 7.
And while PHP-FPM isn’t a core component in NGINX installs, web hosting providers usually include it in their standard PHP environments and/or recommend the vulnerable configuration, meaning that there could be quite a few vulnerable servers out there.
Since exploitation is trivial, admins are advised to check whether their servers are vulnerable by executing a simple bash command:
egrep -Rin –color ‘fastcgi_split_path’ /etc/nginx/
If they are, they should upgrade their PHP version to one that’s not vulnerable. If that’s not possible, the issue can be mitigated through WAF filtering (more details here).
Once that’s done, they should check whether unauthorized modifications have occurred on the system(s) before they were able to apply the patch or the mitigations.
NGINX admins that run PHP7 without PHP-FPM should also upgrade to the latest stable versions offered, as they fix many other bugs and security issues.
Trend Micro and Tenable researchers have offered additional advice and best security practices for deterring threats or intrusions that exploit the vulnerability.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/10/28/cve-2019-11043/