title: Underflow in PHP-FPM can lead to RCE
description: In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
problem types: CWE-120 Buffer Overflow
affected:
{
product: PHP
vendor: PHP
versions:
lessThan: 7.1.33, status: affected, version: 7.1.x, versionType: custom
lessThan: 7.2.24, status: affected, version: 7.2.x, versionType: custom
lessThan: 7.3.11, status: affected, version: 7.3.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]
exploits: Exploit described at https://github.com/neex/phuip-fpizdam
workarounds: Configuring nginx (or other server that implements the front-end part of the FPM protocol) to check for the existence of the target file before passing it to PHP FPM (e.g. "try_files $uri =404" or "if (-f $uri)" in nginx) for would prevent this vulnerability from happening.