Unpacking PHP Core RCEs What You Need to

Deep Dive into PHP Core RCEs

A critical remote code execution (RCE) vulnerability, identified as CVE-2019-11043, affected PHP-FPM in specific Nginx configurations. This flaw allowed unauthenticated attackers to execute arbitrary code on vulnerable servers. This Deep Dive into PHP Core RCEs focuses on this specific vulnerability, its mechanics, and how to defend against such threats.

What the Vulnerability Is and Its Impact

CVE-2019-11043 is a buffer underflow vulnerability within the PHP-FPM component. It specifically impacts PHP versions 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11. The vulnerability's CVSS v3.1 Base Score is 9.8, rating it as Critical. Successful exploitation grants an attacker full system compromise, enabling remote command execution, data exfiltration, and further network penetration. This issue primarily affects PHP-FPM instances running behind an Nginx web server with specific misconfigurations.

Technical Root Cause Analysis

The root cause of CVE-2019-11043 lies in how PHP-FPM processes `PATH_INFO` in conjunction with a particular Nginx configuration. Nginx uses the `fastcgi_split_path_info` directive to parse the URL. It separates the SCRIPT_FILENAME from the PATH_INFO component. A common, yet vulnerable, Nginx configuration uses a regex like `^(.+?\.php)(/.*)$` for `fastcgi_split_path_info` and sets `fastcgi_param PATH_INFO $fastcgi_path_info;`. When an attacker sends a crafted URL, specifically one that causes the `fastcgi_split_path_info` regex to match the `.php` part but results in an empty `PATH_INFO`, the vulnerability triggers. For instance, a URL like `/index.php/something%0A/` where `%0A` is a newline character, can bypass the intended matching. PHP-FPM's `fpm_main.c` contains the `env_path_info` variable. A buffer underflow occurs when the code attempts to calculate the `path_info` value under these specific conditions. This underflow leads to an out-of-bounds write of a single byte. This single-byte write corrupts data structures on the heap, specifically manipulating the `fcgi_data` pointer. The corruption redirects the pointer to an attacker-controlled location, paving the way for arbitrary code execution.

Exploitation Mechanics

Exploiting CVE-2019-11043 requires a specific Nginx and PHP-FPM setup. The Nginx server block must include a `location` directive that passes `.php` requests to PHP-FPM using `fastcgi_pass`, and crucially, defines `fastcgi_split_path_info` with a vulnerable regex.

location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_path_info; # Vulnerable line
}

An attacker crafts a URL that causes the `fastcgi_split_path_info` regex to misinterpret the `PATH_INFO` variable. For example, appending `/.%0A` to a PHP file path can trigger the underflow. The `%0A` (newline character) is key. The Nginx regex `^(.+?\.php)(/.*)$` matches `index.php` as the first group and `/.%0A` as the second group (`PATH_INFO`). However, PHP-FPM's internal parsing, specifically related to `PATH_INFO` handling, miscalculates the buffer size when encountering the newline. This leads to the `env_path_info` underflow. The subsequent out-of-bounds write overwrites a critical `_fcgi_put_last_len` pointer. Attackers can control the value written to this pointer by carefully manipulating the URL, leading to the execution of attacker-supplied code embedded in the request. The exploit essentially turns a memory corruption into an arbitrary write primitive, which is then used to achieve RCE.

Detection: How to Check if You're Affected

Organizations must check their PHP and Nginx configurations for this Deep Dive into PHP Core RCEs vulnerability. First, identify the PHP version running on your servers. Versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 are vulnerable. You can use Secably's free website vulnerability scanner or technology stack detector to quickly identify the PHP version of publicly accessible web servers. Next, inspect your Nginx configuration files. Look for `location` blocks that handle PHP requests. Specifically, examine the `fastcgi_split_path_info` directive and how `PATH_INFO` is set. A vulnerable configuration will have `fastcgi_split_path_info` with a regex matching PHP files, and `fastcgi_param PATH_INFO $fastcgi_path_info;` without sufficient validation or an anchor. Tools like Zondex can help identify exposed Nginx instances and their configurations. Manually review relevant Nginx configuration files, typically located in `/etc/nginx/nginx.conf`, `/etc/nginx/sites-available/`, or within your web application's specific configuration directories. Look for the exact pattern `fastcgi_split_path_info ^(.+?\.php)(/.*)$;` combined with `fastcgi_param PATH_INFO $fastcgi_path_info;`. The absence of an `if_not_empty` check or a more restrictive regex is a strong indicator of vulnerability.

Remediation Steps

Immediate remediation involves upgrading PHP. Update to PHP 7.1.33, 7.2.24, 7.3.11, or newer versions. These versions contain the patch addressing the buffer underflow. Adjust your Nginx configuration to prevent the `PATH_INFO` bypass. Modify the `fastcgi_param PATH_INFO` line. Change it to include an `if_not_empty` condition:

fastcgi_param PATH_INFO $fastcgi_path_info if_not_empty;

Alternatively, strengthen the `fastcgi_split_path_info` regex to ensure proper path handling. A more secure regex explicitly anchors the `.php` extension to prevent arbitrary path information from being parsed as part of the script name. Consider using a regex like `^(.+\.php)(.*)$` and verifying that `$fastcgi_path_info` is properly handled. Ensure `cgi.fix_pathinfo` is disabled in your `php.ini` if not explicitly required. Set `cgi.fix_pathinfo=0`. This setting prevents PHP from attempting to "fix" paths by guessing script names, which can introduce vulnerabilities when misconfigured. Restart both Nginx and PHP-FPM services after applying changes. Regular vulnerability scanning using platforms like Secably helps maintain continuous security posture. Refer to vendor advisories for specific patching instructions for your operating system or PHP distribution.

Timeline of Disclosure

The vulnerability CVE-2019-11043 was publicly disclosed in October 2019. Security researchers Emil Lerner, Orange Tsai, and Meh Chang (DEVCORE) are credited with its discovery and analysis. The official PHP advisory for bug #78599, which corresponds to this issue, details the `env_path_info` underflow. PHP released patched versions (7.1.33, 7.2.24, and 7.3.11) on October 24, 2019, shortly after the public disclosure. Proof-of-Concept exploits became publicly available quickly, leading to widespread exploitation attempts in the wild. CISA added CVE-2019-11043 to its Known Exploited Vulnerabilities Catalog, mandating remediation by April 15, 2022.