PHP-FPM Path Info Buffer Underflow - Remote Code Execution

id: CVE-2019-11043

info:
  name: PHP-FPM Path Info Buffer Underflow - Remote Code Execution
  author: Prasath from Securin Labs (https://securin.io)
  severity: critical
  description: |
    In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation.
  remediation: |
    Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later. As mitigation, remove the fastcgi_split_path_info directive or ensure it cannot match an empty PATH_INFO.
  reference:
    - https://bugs.php.net/bug.php?id=78599
    - https://github.com/neex/phuip-fpizdam
    - https://www.nginx.com/blog/nginx-php-fastcgi-process-manager/
    - https://security.netapp.com/advisory/ntap-20191031-0001/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11043
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-11043
    cwe-id: CWE-119
    epss-score: 0.9947
    epss-percentile: 0.99939
    cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: php
    product: php
    shodan-query: title:"PHP" port:80,443
    fofa-query: app="PHP"
  tags: cve,cve2019,php,php-fpm,nginx,rce,fastcgi,kev,vkev

http:
  - raw:
      - |
        GET /index.php/%0a HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /index.php/%0atest HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: php_version
        part: header
        group: 1
        regex:
          - "(?i)X-Powered-By:\\s*PHP/([0-9]+\\.[0-9]+\\.[0-9]+)"
        internal: true

    matchers-condition: and
    matchers:
      - type: status
        part: header
        status:
          - 200
        condition: and

      - type: word
        part: header
        words:
          - "X-Powered-By: PHP"
          - "x-powered-by: php"
        condition: or
        case-insensitive: true

      - type: regex
        part: header
        regex:
          - "(?i)X-Powered-By:\\s*PHP/(7\\.(0|1|2|3)\\.[0-9]+|5\\.[0-9]+\\.[0-9]+)"

      - type: dsl
        dsl:
          - |
            compare_versions(php_version, ">= 7.0.0", "< 7.1.33") ||
            compare_versions(php_version, ">= 7.2.0", "< 7.2.24") ||
            compare_versions(php_version, ">= 7.3.0", "< 7.3.11")
# digest: 490a004630440220656703cf6ddef693309d400312e81e6c737125d670e462cb93aecbdb1ff8513002201253deaa4339fca95651ce771ca6a500b951fad6bf8ae8e8c92816be00bcdbf6:922c64590222798bb761d5b6d8e72950