A vulnerability in php-fpm that allows remote code execution on the server

Available corrective releases PHP 7.3.11, 7.1.33, and 7.2.24, in which has been closed critical vulnerability (CVE-2019-11043) in the PHP-FPM extension (FastCGI Process Manager) that allows remote execution of your code on the system. An attack on servers running PHP scripts with PHP-FPM in conjunction with Nginx is already publicly available exploitable exploit.

An attack is possible in Nginx configurations where the pass to PHP-FPM is done with URL part separation using "fastcgi_split_path_info" and the definition of the environment variable PATH_INFO, but without prior file existence checking by the directive "try_files $fastcgi_script_name" or the construction "if (!-f $document_root$fastcgi_script_name)". The issue also manifests in the settings recommended for the NextCloud platform. For instance, configurations with constructions such as:

location ~ [^\/]\.php(\/|$) {
fastcgi_split_path_info ^(.+?\.php)(\/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass php:9000;
}

You can track the resolution of the issue in the distributions on these pages: Debian, SUSE/openSUSE, Ubuntu, Arch, FreeBSD, ALT, Alpine. As a workaround, after the line "fastcgi_split_path_info" you can add a check for the existence of the requested PHP file:

try_files $fastcgi_script_name =404;

The issue is caused by an error when manipulating pointers in the file sapi/fpm/fpm/fpm_main.c. When assigning a pointer, it is assumed that the value of the environment variable PATH_INFO must contain a prefix matching the path to the PHP script.
If the fastcgi_split_path_info directive specifies path separation using a regular expression sensitive to newline characters (for example, many examples suggest using "^(.+?\.php)(\/.*)$"), an attacker may achieve recording an empty value in the PATH_INFO environment variable. In this case, further along is performed writing to path_info[0] zero and calling FCGI_PUTENV.

By requesting a specifically crafted URL, an attacker can shift the pointer to path_info to the first byte of the "_fcgi_data_seg" structure, and writing a zero to this byte will move the "char* pos" pointer to an earlier part of memory. The subsequent FCGI_PUTENV call will overwrite the data in this memory with a value that the attacker can control. This memory also holds the values of other FastCGI variables, and by writing their own data, the attacker can create a fake PHP_VALUE variable to execute their code.

Source: opennet.ru