Wednesday, May 22, 2024

PHP7 Remote Code Execution Bug Let Hackers Hijack Websites Running On NGINX Servers

A new recently patched remote code execution bug in PHP7 lets hackers hijack the websites running on some NGINX and php-fpm configurations. The vulnerability can be tracked as CVE-2019-11043.

The vulnerability resides in env_path_info in the file fpm_main.c of the FPM component. The FPM is the php-fpm module used for performance enhancement.

The manipulation of the file leads to memory corruption, chaining with other vulnerabilities allows attackers to remotely execute arbitrary code on web servers with vulnerable configurations.

PHP7 Vulnerability Detected

The vulnerability was found by security researcher Andrew Danau in a Realworld CTF program that took place between September 14th to 16th, 2019.

“When Andrew Danau sent %0a (newline) byte in the URL, the server response was peculiar. It returns more data than should be there. And, the amount of extra data was related to the number of bytes after %0a inside the URL”

   location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        fastcgi_param PATH_INFO       $fastcgi_path_info;
        fastcgi_pass   php:9000;

This sort of response could cause a memory corruption issue and may lead to information disclosure. Andrew, CTF players Emil and Omar decide to investigate further and exploit the issue.

“The reason for this issue is under the hood of the Nginx+fastcgi bundle, in particular, in a fastcgi_split_path directive and a regexp tricks with newlines. Because of %0a character, Nginx will set an empty value to this variable, and fastcgi+PHP will not expect this,” reads wallarm blog post.

Emil published a PoC exploit, which shows certain conditions need to be satisfied to exploit this vulnerability.

  • Nginx + php-fpm to configured request forwarding to php-fpm
  • The fastcgi_split_path_info directive must be there and contain a regexp starting with ^ and ending with $.
  • The PATH_INFO variable to be assigned by fastcgi_param
  • No checks in place such try_files $uri =404 or if (-f $uri) to determine the existence of the file.
  • If the conditions satisfied the exploit works on PHP 7+ versions. The bug may also present in older versions.

So if every condition satisfies attackers be able to execute payloads by appending ?a= to the script.


Following are the mitigations from Nextcloud

  • If you are not using NGINX then this vulnerability will not affect you.
  • Users are recommended to update with the latest versions 7.1.33,7.2.24 & 7.3.11.
  • Recommended removal of $request_uri

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles