ianxtianxt/cve-2019-11043Remote code execution exploit for CVE-2019-11043 targeting Nginx with php-fpm. Includes Go and pre-compiled exploit binaries for testing vulnerable configurations.
Vulnerability Description
When Nginx's fastcgi_split_path_info processes requests containing %0a, it encounters a newline \n causing PATH_INFO to be empty. Meanwhile, php-fpm has a logic flaw when handling empty PATH_INFO. An attacker can achieve remote code execution through careful construction and exploitation. When Nginx's fastcgi_split_path_info processes requests containing %0a, it encounters a newline \n causing PATH_INFO to be empty. Meanwhile, php-fpm has a logic flaw when handling empty PATH_INFO. An attacker can achieve remote code execution through careful construction and exploitation.
Affected Scope
Servers running Nginx + php-fpm with the following configuration may be vulnerable to remote code execution.
location ~ [^/].php(/|$) { fastcgi_split_path_info ^(.+?.php)(/.*)$; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_pass php:9000; ... } }
Solution
If it does not affect normal business, remove the following configuration from the Nginx configuration file:
fastcgi_split_path_info ^(.+?.php)(/.*)$; fastcgi_param PATH_INFO $fastcgi_path_info;
Includes two exploits, one written in Go and another pre-compiled.
./phuip-fpizdam http://192.168.93.131:8080/index.php
