PHP < 7.1.33, 7.2.x < 7.2.24, 7.3.x < 7.3.11 RCE Vulnerability - Version Check

# SPDX-FileCopyrightText: 2019 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:php:php";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108692");
  script_version("2025-09-24T05:39:03+0000");
  script_tag(name:"last_modification", value:"2025-09-24 05:39:03 +0000 (Wed, 24 Sep 2025)");
  script_tag(name:"creation_date", value:"2019-10-25 11:55:00 +0000 (Fri, 25 Oct 2019)");
  script_tag(name:"cvss_base", value:"7.5");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2020-08-18 15:05:00 +0000 (Tue, 18 Aug 2020)");

  script_cve_id("CVE-2019-11043");

  # nb: Only hosts running PHP via php-fpm AND nginx with a special config are affected
  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("PHP < 7.1.33, 7.2.x < 7.2.24, 7.3.x < 7.3.11 RCE Vulnerability - Version Check");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2019 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_php_consolidation.nasl");
  script_mandatory_keys("php/detected");

  script_tag(name:"summary", value:"PHP is prone to a remote code execution (RCE) vulnerability in
  certain nginx + php-fpm configurations.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The file sapi/fpm/fpm/fpm_main.c contains pointer arithmetic
  that assumes that env_path_info has a prefix equal to the path to the php script. However, the
  code does not check this assumption is satisfied. The absence of the check can lead to an invalid
  pointer in the 'path_info' variable.

  Such conditions can be achieved in a pretty standard Nginx configuration. The regexp in
  `fastcgi_split_path_info` directive can be broken using the newline character (in encoded form,
  %0a). Broken regexp leads to empty PATH_INFO, which triggers the bug.");

  script_tag(name:"impact", value:"Successful exploitation would allow an unauthenticated remote
  attacker to execute arbitrary code on the target machine.");

  script_tag(name:"affected", value:"PHP prior to version 7.1.33, 7.2.x prior to 7.2.24 and 7.3.x
  prior to 7.3.11.");

  script_tag(name:"solution", value:"Update to version 7.1.33, 7.2.24, 7.3.11 or later.

  As an alternative a workaround to update the nginx configuration to mitigate this vulnerability is
  described at the PHP.net bugtracker linked in the references.");

  script_xref(name:"URL", value:"https://bugs.php.net/bug.php?id=78599");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.3.11");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.2.24");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.1.33");
  script_xref(name:"URL", value:"https://github.com/neex/phuip-fpizdam");
  script_xref(name:"URL", value:"https://www.cisa.gov/known-exploited-vulnerabilities-catalog");
  script_xref(name:"CISA", value:"Known Exploited Vulnerability (KEV) catalog");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "7.1.33")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.1.33", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "7.2.0", test_version2: "7.2.23")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.2.24", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "7.3.0", test_version2: "7.3.10")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.3.11", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);