sepkascurty-cpu/cve-2022-31630---proof-of-concept-exploit-untuk-php-7.4.33
#CVE-2022-31630 - Proof of Concept Exploit for PHP 7.4.33
Warning: This code is created solely for educational purposes and testing in an isolated laboratory environment. Use on other systems without authorization is illegal and irresponsible.
📋 Description
CVE-2022-31630 is an Out-of-Bounds (OOB) Read vulnerability in the PHP GD extension, specifically in the imageloadfont() function. This vulnerability allows an attacker who can control the font file loaded by a PHP application to read data beyond the allocated buffer boundary, which can lead to:
· Denial of Service (crash) · Information Disclosure (leaking sensitive memory contents)
This vulnerability affects PHP versions:
· 7.4.x before 7.4.33 · 8.0.x before 8.0.25 · 8.1.x before 8.1.12
PHP 7.4.33 is the first version to receive a patch for this CVE. Therefore, the exploit code in this repository will demonstrate the behavioral difference between a vulnerable version (≤ 7.4.32) and a patched version (≥ 7.4.33).
🔬 Technical Details
The vulnerability lies in the lack of input validation when reading the header of a GD font file (.gdf). The font file has a header with the structure:
· 2 bytes: magic number (0x01BE) · 2 bytes: number of characters (nchars) · 2 bytes: character width in pixels (width) · 2 bytes: character height (height) · 2 bytes: bytes per character offset (char_offset)
If the width value is set very large (e.g., 65535), PHP will allocate a buffer that is too small to store the font bitmap data. When imagechar() later reads a character from that font, it accesses memory outside the buffer boundary, causing an OOB read.
🚀 Usage
📚 References
· CVE-2022-31630 at NVD · Patch commit at php-src · PHP Release Announcements
Created for educational purposes at CVE
