Other nomination

PHP-FPM RCE(CVE-2019-11043)

Orange Tsai · Orange Tsai · 29 October 2019

A newline in the URI makes nginx pass an empty PATH_INFO to PHP-FPM, so a pointer calculation underflows and writes a null byte before the buffer, corrupting the FastCGI environment allocator. A following putenv then overwrites a hash-colliding fake request header with PHP_VALUE, letting an unauthenticated attacker set php.ini directives and run commands.

Record

Researcher

Orange Tsai

Published by

Orange Tsai

Date

29 October 2019

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Original exploit
• Original vulnerability report

Tags

• php
• rce
• url-parsing
• reverse-proxy
• cve
• attack-chain

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host.