bayazid-bit/cve-2019-11043CVE-2019–11043: PHP-FPM Nginx Remote Code Execution Vulnerability
CVE-2019–11043 is a remote code execution (RCE) vulnerability. It affects PHP-FPM, which is a FastCGI Process Manager that is commonly used with Nginx web servers. The flaw arises from inadequate parsing of the PHP-FPM on buffer limitations when handling requests through the Nginx connection. An attacker can take advantage of this by sending an HTTP request that can be manipulated allowing the attacker to run code on the affected server.
The impact is significant: when successful exploitation can result in full system compromise which enables the attackers to: Execute commands remotely, Leak identification data such as logs, accounts, user data, etc, and, Exploit the compromised server for subsequent attacks on an organization such as DDoS attacks or to move deeper into the specified network space.
It usually affects the hosts that are hosting PHP applications in production environments Nginx-PHP-FPM misconfiguration, which makes the compromised threat common and easy to exploit.
The vulnerability PHP-FPM CVE-2019–11043 was announced in October 2019 by the team that found it during the security audit of this open-source software. Soon after that, the researchers created a Proof of Concept exploit to show how it can be exploited to achieve remote code execution with ease. After disclosure, but since this was a critical flaw that involved updating core infrastructure components (Nginx and PHP), many servers were left open to the vulnerability due to the time it takes for patch updates to be implemented and be in force. This flaw was quickly incorporated into tools like Metasploit, where penetration testers can utilize it relatively easily.
The vulnerability received more attention because it is easy to exploit, and once a hacker achieves that, he gets almost complete control over the victim’s system. Therefore, CVE-2019–11043 continued to be exploited by attackers well over several months after the vulnerability was disclosed.
CVE-2019–11043 can be exploited using this exploit.
python3 CVE-2019-11043.py <target url>
it will open a shell for you
The attacker uses a relevant URL to perform a crafted HTTP request toward the Nginx server to overflow a designated buffer. Remote Code Execution: After this request is processed the system is susceptible to a memory overflow, the attacker then controls full execution on the system. Gaining Access: In the system shell, the attacker can perform a range of actions that include the download of malware, copying of data, and alteration of server configurations.