A php-fpm vulnerability that allows remote code execution on the server

Available corrective releases PHP 7.3.11, 7.1.33 and 7.2.24, which eliminates critical vulnerability (CVE-2019-11043) in the PHP-FPM extension (FastCGI process manager), which allows remote execution of code in the system. For servers using PHP-FPM in conjunction with Nginx to run PHP scripts, a publicly available working exploit.

An attack is possible in Nginx configurations where the PHP-FPM passthrough is handled using 'fastcgi_split_path_info' and the PATH_INFO environment variable is set, but without a prior existence check of the file with the 'try_files $fastcgi_script_name' directive or the 'if (!-f $document_root$fastcgi_script_name)' construction. The issue also manifests in settings recommended for the NextCloud platform. For example, configurations with constructs like:

location ~ [^\/]\.php(\/|$) {
fastcgi_split_path_info ^(.+?\.php)(\/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass php:9000;
}

You can track the resolution of the issue in distributions on the following pages: Debian, RHEL, Ubuntu, SUSE/openSUSE, FreeBSD, Arch, Fedora. As a workaround, after the 'fastcgi_split_path_info' line, you can add a check for the existence of the requested PHP file:

try_files $fastcgi_script_name =404;

The problem is caused by a bug in pointer manipulation in the file sapi/fpm/fpm/fpm_main.c. When assigning the pointer, it is assumed that the value of the PATH_INFO environment variable must contain a prefix matching the path to the PHP script.
If the separation of the script path is specified in the fastcgi_split_path_info directive using a regular expression sensitive to passing newline characters (for example, many examples suggest using '^(.+?\.php)(\/.*)$'), the attacker can achieve an empty value assignment to the PATH_INFO environment variable. In this case, further down the execution path a write is performed to path_info[0] zero and a call to FCGI_PUTENV.

Ha a támadó egy adott formátumú URL-t kér, akkor elérheti a path_info mutató eltolását a «_fcgi_data_seg» struktúra első bájtjára, és ha a mutatóba nullát ír, a «char* pos» mutató a korábban elhelyezett memóriaterületre fog átkonfigurálódni. A következő FCGI_PUTENV hívás felülírja az ebben a memóriában található adatokat, amelyet a támadó irányíthat. A megadott memóriában más FastCGI változók értékei is tárolódnak, és a támadó saját adatait beírva létrehozhat egy hamis PHP_VALUE változót, és ezzel a saját kódját futtathatja.

Forrás: opennet.ru