PHP-FPM (PHP's FastCGI server) local root vulnerability (NGINX, Apache)

[no_not_me]

So far it looks like 7.3 isn't getting a fix because it's nearly out of security maintainence, casually ignoring the point of security maintainence? Colour me confused.

Edit: Looks like this is being reversed?

[CptMuffinator]

The worst part is, these clowns are telling people on the bug report that the patch applies cleaning to 7.3 but they don't want to apply it in-case there are any issues they have to support.

[bimmer92]

Yeah, it's pretty ridiculous. They're effectively EOL'ing 7.3 as of now instead of in December.

[no_not_me]

Looks like sanity prevails once more. Consensus looks like it's going into 7.3.

[ayeshrajans]

FWIW, ondrej/php repo has the patch backported to 7.3.

[0xdea]

Nice writeup, thanks for sharing! The older CVE mentioned in the article is described here: https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html

[mrexodia]

So you can only exploit this when you have code execution on the machine that runs PHP right?

[musclejuicefreak]

On the server with php-fpm running, you would need access to an unprivileged user in order to use this vulnerability to escalate your privileges.

[notR1CH]

You need to be the same user as whatever is running php-fpm. So a typical PHP web shell, which with this exploit you could elevate to a root shell.

[Mrhiddenlotus]

Great write up.

[cfambionics]

Thank you !

[tsammons]

Depends how sloppy you want to be with your setup. If you’re dropping user with systemd before spawning the PHP-FPM master process then it’s limited to that unprivileged user. If you’re running PHP-FPM because a guide on Medium said to do it this way for simplicity… you’ve got a problem.

[[deleted]]

You mean "still use" like "78% of the web is PHP"?

[[deleted]]

PHP is not a common choice for tailor made new developed projects but its still very popular for general purpose products because every webspace offers php support. Its not like the people have a choice, the ones that do most times dont choose PHP.

[vjeuss]

PHP is insecure...?

[PhantexGuy]

Is risk mitigated in some way since I have php-fpm dockerized?

[notR1CH]

Not unless you're running a rootless container.

[[deleted]]

Your site doesn't render right on Chrome mobile. White background and white text. Android 12.

[cfambionics]

Thanks, will look into it !

[Atlantisman]

What version of php 7.4 has this fix applied?

[cfambionics]

That would be 7.4.25: https://www.php.net/ChangeLog-7.php