# MA-756.102019: MyCERT Alert - Vulnerability in PHP-FPM Could Lead to Remote Code Execution (RCE)

**Date:** 30 Oct 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-756.102019  
**Advisory ID:** MA-756.102019

---

**1.0 Introduction**
Security researchers found env\_path\_info underflow flaw in PHP-FPM’s fpm\_main.c. CVE-2019-11043 has been assigned to address this vulnerability.
**2.0 Impact**
Attackers can send specially crafted requests in the URL to a vulnerable web server to execute operating system (OS) commands.
**3.0 Affected System and Devices**
NGINX web servers with PHP7+ PHP-FPM component enabled with [certain configurations.](https://github.com/neex/phuip-fpizdam#the-full-list-of-preconditions)
Nginx + php-fpm, location ~ [^/]\.php(/|$) must be forwarded to php-fpm
The fastcgi\_split\_path\_info directive must be there and contain a regexp starting with ^ and ending with $, so we can break it with a newline character.
There must be a PATH\_INFO variable assignment via statement fastcgi\_param PATH\_INFO $fastcgi\_path\_info;. At first, we thought it is always present in the fastcgi\_params file, but it's not true.
No file existence checks like try\_files $uri =404 or if (-f $uri). If Nginx drops requests to non-existing scripts before FastCGI forwarding, our requests never reach php-fpm. Adding this is also the easiest way to patch.
**4.0 Recommendations**
PHP 7.3.11 (current stable) and PHP 7.2.24 (old stable) were released to address this vulnerability along with other scheduled bug fixes on 24th October. Those using nginx with PHP-FPM are encouraged to upgrade to a [patched version](https://www.php.net/downloads.php) as soon as possible.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://bugs.php.net/bug.php?id=78599>
2. <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11043>
3. <https://www.tenable.com/blog/cve-2019-11043-vulnerability-in-php-fpm-could-lead-to-remote-code-execution-on-nginx>
4. <https://www.zdnet.com/article/nasty-php7-remote-code-execution-bug-exploited-in-the-wild>/
5. <https://github.com/neex/phuip-fpizdam>
6. <https://lab.wallarm.com/php-remote-code-execution-0-day-discovered-in-real-world-ctf-exercise/>