PHP-FPM buffer underflow

Certain PHP-FPM setups on the 7.1, 7.2 and 7.3 branches. Public exploitation targeted nginx configurations that pass PATH_INFO using fastcgi_split_path_info.

Vulnerable versions: PHP 7.1 before 7.1.33, 7.2 before 7.2.24 and 7.3 before 7.3.11, in certain PHP-FPM setups.

How it works

In certain PHP-FPM configurations, it is possible to cause the FPM module to write past allocated buffers into space reserved for FastCGI protocol data. NVD describes this as opening the possibility of remote code execution.

Base score: 9.8 Critical (CVSS 3.1, NVD).

1. Find nginx sites that pass requests to PHP-FPM, and check their configuration for fastcgi_split_path_info with PATH_INFO passed to PHP.
2. Compare the PHP-FPM version with the fixed releases, using the FPM binary that serves the site rather than the command-line version.
3. PHP 7.0 had already reached end of life, so any fix for it would come from a vendor backport. The PHP 7 branches are all end of life now; plan a move to a supported branch.
4. CISA lists this vulnerability as known to be exploited. Review exposed servers for signs of compromise.

Need this checked across your servers? A PHP response assessment records the runtime serving each site and its patch status, in writing.