asty PHP7 remote code execution bug exploited in the wild

Experts warn of a remote code execution vulnerability in PHP7, tracked as CVE-2019-11043, has been exploited in attacks in the wild.

A remote code execution vulnerability in PHP7, tracked as CVE-2019-11043, has been exploited in attacks in the wild.

On October 22, the security expert Omar Ganiev announced via Twitter the availability of a “freshly patched” remote code execution vulnerability in PHP-FPM, the FastCGI Process Manager (FPM) for PHP.

The researchers also shared a link to the PoC code published on the GitHub repository.

Freshly patched RCE in PHP-FPM:https://t.co/kaVsCStBJx

Exploit:https://t.co/VLmhxMWVxo

Many nginx+PHP configurations vulnerable, watch out! — BECHED (@ahack_ru) October 22, 2019

The CVE-2019-11043 flaw doesn’t request specific skills to be exploited and take over servers, it is an env_path_info underflow flaw in PHP-FPM’s fpm_main . c. Thin means that the issue only impacts NGINX servers with PHP-FPM enabled.

The flaw was first reported to the PHP bug-tracker by security expert Emil Lerner on September 26, 2019 that also credited the researcher Andrew Danau for the issue. Danau discovered the vulnerability during a Capture The Flag competition in September 2019.

Lerner explained that the vulnerability could be exploited to gain remote code execution under certain configurations where a web server is using nginx and PHP-FPM,

“The PoC script included in the GitHub repository can query a target web server to identify whether or not it is vulnerable by sending specially crafted requests.” reads the analysis published by Tenable. “Once a vulnerable target has been identified, attackers can send specially crafted requests by appending “?a=” in the URL to a vulnerable web server.”

On October 24, PHP maintainers released PHP 7.3.11 (current stable) and PHP 7.2.24 (old stable) that addressed the CVE-2019-11043 vulnerability. Administrators using nginx with PHP-FPM urge to upgrade their installs as soon as possible.

The maintainers also suggested a workaround that consists in either by including the try_files directive or using an if statement, such as if (-f $ uri ).

Pierluigi Paganini