ctf-cve-2019-11043

タスク管理アプリ CVE-2019-11043 ラボ CVE-2019-11043を再現するための、意図的に脆弱性を持たせたNginx/PHP-FPM構成の最小限のPHPアプリです。小さなタスクマネージャー、ログイン/管理、DB設定UIが含まれています。 ビルドと実行 Docker build docker build -t cve-2019-11043-lab:app . run docker run --rm -p 8080:80 cve-2019-11043-lab:app open open http://localhost:8080/ エクスプロイトクイックスタート...

CVE-2019-11043

PoC CVE-2019-11043 CVE-2019-11043 익스플로잇의 Python 구현 CVE-2019-11043로 기록된 이 익스플로잇은 NGINX 서버와 함께 PHP-FPM 구현의 버그를 이용합니다. 특정 구성에서 FastCGI pathinfo의 정규 표현식으로 인해 FPM 모듈이 할당된 버퍼를 넘어 FastCGI 프로토콜 데이터를 위해 예약된 공간에 쓰게 됩니다. 그 결과, 웹 사용자가 원격으로 코드를 실행할 수 있게 됩니다. 다음 표는 Common Vulnerability Scoring System CVSS에 따른...

BIT-PHP-MIN-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BIT-PHP-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BIT-LIBPHP-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

Rocky Linux 10.2 [CIQ] Security Update: haproxy / haproxy-debuginfo / haproxy-debugsource Multiple Vulnerabilities (crlsa-2026_55679)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655679 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

Rocky Linux 9 [CIQ] Security Update: haproxy / haproxy-debuginfo / haproxy-debugsource Multiple Vulnerabilities (crlsa-2026_55772)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655772 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in...

CVE-2019-11043

CVE-2019-11043 PHP-FPM リモートコード実行 スクリーンキャスト: https://youtu.be/d6benC5FVZM 概要 このゼロデイエクスプロイトは、一般的な PHP-FPM 構成において、2019 年の Realworld CTF コンペティション中に発見されました。リクエスト URI を解析するために正規表現が使用されますが、改行文字 %0a はマッチしません。これにより、クエリ文字列の長さを誤って計算し、意図したバッファの 前 の位置にヌルバイトを書き込む FastCGI...

SUSE CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2019-11043

PoC CVE-2019-11043 CVE-2019-11043 エクスプロイトの Python 版 https://github.com/neex/phuip-fpizdam この PoC はまだドラフトです。@neex が作成したエクスプロイトを使用してください。 脆弱性分析: https://paper.seebug.org/1064/ PoC のセットアップ nginx と php-fpm を起動するには、docker compose を実行するだけです: docker-compose up -d Creating network...

CVE-2019-11043

CVE-2019-11043 0th3rs 보안 팀 ====================== PHP 7.1.x 7.1.33 미만, 7.2.x 7.2.24 미만, 7.3.x 7.3.11 미만 버전에서 PHP 7.2.20/7.3.10에서 테스트됨 지침 1. 비교적 안정적이며, 쿼리 길이와 헤더 헤더 필드 길이를 브루트포스만 하면 됩니다. 2. autosession으로 취약점 존재 여부 탐지 3. 대상 워커 프로세스 수를 판단하여 견고성 구현 4. 모든 워커 프로세스 오염 Nginx 설정 location ^/.php/|$...

DEBIAN-CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

AZL-104895 CVE-2026-91768 affecting package php 8.3.33-1

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

UBUNTU-CVE-2026-91768

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-91768

The PHP FastCGI client contains an IPv6 access control bypass vulnerability (CVE-2026-91768 ). The issue stems from the IPv6 branch of the FastCGI client access check, which incorrectly compares only the first 12 bytes of a 16-byte IPv6 address. This causes listen.allowed_clients to match on a /9...

EUVD-2026-87350

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...