Hackers are using a bug in PHP7 to remotely hijack web servers
Tags: php, security, cybersecurity, infosec
Published: 2019-10-28 12:20:36

---
title: "Hackers are using a bug in PHP7 to remotely hijack web servers"
cover_image: "https://thepracticaldev.s3.amazonaws.com/i/g1dis6pxj9y4e7hw0jkc.png"
published: true
description: "A new recently patched remote code execution bug in PHP7 lets hackers hijack the websites running on some NGINX and php-fpm configurations."
tags: "php,security,cybersecurity,infosec"
---

In [this article](https://gbhackers.com/php7/) by GBHackers, and on [this other one](https://thenextweb.com/dd/2019/10/27/hackers-are-using-a-bug-in-php7-to-remotely-hijack-web-servers/) by the TheNextWeb, we can learn that [Emil Lerner](https://github.com/neex) have disclosed the vulnerability in the [PHP bug tracker]((https://bugs.php.net/bug.php?id=78599) ), and it have been classified has the [CVE-2019-11043](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11043).

In a nutshell this vulnerability allows an attacker to take control of any server running PHP7 with Nginx and the PHP-FPM extension, just by adding to the url of the website `?a='payload-here`, and you can see  the [proof of concept](https://github.com/neex/phuip-fpizdam) for a more detailed explanation on how this remote code execution vulnerability is exploitable.


## TLDR

### The vulnerability

[GBHackers](https://gbhackers.com/php7/)

> The vulnerability resides in env_path_info in the file fpm_main.c of the FPM component. The FPM is the php-fpm module used for performance enhancement.

> The manipulation of the file leads to memory corruption, chaining with other vulnerabilities allows attackers to remotely execute arbitrary code on web servers with vulnerable configurations.

### How can be exploited

[TheNextWeb](https://thenextweb.com/dd/2019/10/27/hackers-are-using-a-bug-in-php7-to-remotely-hijack-web-servers/):

> With this vulnerability, which has the CVE-ID of 2019-11043, an attacker could force a remote web server to execute their own arbitrary code simply by accessing a crafted URL. The attacker only needs to add “?a=” to the website address, followed by their payload.

### Who is affected

[TheNextWeb](https://thenextweb.com/dd/2019/10/27/hackers-are-using-a-bug-in-php7-to-remotely-hijack-web-servers/):

> Fortunately, the vulnerability only impacts servers using the NGINX web server with the PHP-FPM extension. PHP-FPM is a souped-up version of FastCGI, with a few extra features designed for high-traffic websites.


### Mitigation

[GBHackers](https://gbhackers.com/php7/):

> Following are the [mitigations](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/) from Nextcloud

> * If you are not using NGINX then this vulnerability will not affect you.
> * Users are recommended to update with the latest versions 7.1.33,7.2.24 & 7.3.11.
> * Recommended removal of $request_uri

[TheNextWeb](https://thenextweb.com/dd/2019/10/27/hackers-are-using-a-bug-in-php7-to-remotely-hijack-web-servers/):

> Site owners who are unable to update their PHP install can mitigate the problem by setting a rule within the standard PHP mod_security firewall. Instructions on how to do this can be found on the website of appsec startup [Wallarm](https://lab.wallarm.com/php-remote-code-execution-0-day-discovered-in-real-world-ctf-exercise/).


## DISCUSSION

Are you gonna take this seriously, and take action or you will just think that only happen to others?


## Credits

Cover image credit goes for [GBHackers](https://gbhackers.com/).