CVE-1999-0238

Executive Summary

This report provides a detailed analysis of CVE-1999-0238, a critical arbitrary file reading vulnerability in obsolete versions of PHP, specifically PHP/FI 2.x and PHP 3.x prior to version 3.0.10. The vulnerability resides in the php.cgi binary, which fails to properly sanitize user-supplied input from the URL's query string. An unauthenticated remote attacker can exploit this flaw by crafting a simple HTTP GET request to read any file on the server's filesystem, limited only by the web server's file permissions.

With a CVSS 2.0 base score of 10.0 (Critical), this vulnerability grants attackers complete access to sensitive data, such as password files (/etc/passwd), configuration files containing credentials, and application source code. This level of access almost invariably leads to a full system compromise. Given the age of the affected software and its "UNPATCHED" status, any system still running these versions is considered dangerously insecure and must be decommissioned or upgraded immediately.

CVSS Breakdown & Threat Level

The assigned CVSS v2.0 score of 10.0 reflects the maximum possible risk for a vulnerability.

• Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
• Attack Vector: Network (AV:N): The vulnerability is exploitable remotely over a network without requiring any local access.
• Attack Complexity: Low (AC:L): The exploit requires no special conditions or configuration. A simple, crafted URL is sufficient to trigger the vulnerability.
• Authentication: None (Au:N): The attacker does not need to be authenticated to the target system.
• Confidentiality Impact: Complete (C:C): An attacker can read any file on the system that the web server process has access to, leading to a total loss of confidentiality. This includes system credentials, application source code, and private user data.
• Integrity Impact: Complete (I:C): While the primary impact is file disclosure, this information leak (e.g., database credentials, private keys) allows an attacker to gain further access and modify system data, leading to a complete loss of integrity.
• Availability Impact: Complete (A:C): An attacker could read sensitive system files that, if disclosed, could lead to a full system takeover and subsequent denial of service.

The 10.0 score is fully justified, as a successful exploit provides an unauthenticated attacker with the necessary information to achieve full control over the affected server.

Deep Dive & Mechanics

This vulnerability stems from the way early versions of PHP handled CGI (Common Gateway Interface) requests. The php.cgi binary was responsible for parsing and executing PHP code. When a request was made, such as http://example.com/cgi-bin/php.cgi?/path/to/script.php, the web server would execute php.cgi and pass the query string (/path/to/script.php) as a command-line argument.

The flaw occurs because php.cgi directly interpreted this argument as the file to be processed without performing any validation or sanitization. It did not check for path traversal sequences (../) or verify that the requested file was within the web document root.

Therefore, an attacker could request a file outside of the intended directory. For example, if the attacker requests http://example.com/cgi-bin/php.cgi?/etc/passwd, the php.cgi binary receives /etc/passwd as the file to process. Since /etc/passwd contains no PHP tags (<?php ... ?>), the PHP interpreter simply outputs the file's raw content directly to the user's browser.

Common exploit patterns include:

1. Absolute Path: Requesting a known file with its full path.

   GET /cgi-bin/php.cgi?/etc/passwd HTTP/1.0
   

2. Path Traversal: Using ../ sequences to navigate up from the web directory to sensitive locations.

   GET /cgi-bin/php.cgi?../../../../../../etc/shadow HTTP/1.0
   

Vulnerable vs. Patched Code

As this vulnerability is over two decades old, obtaining the original source for a direct diff is impractical. Instead, the logical flaw can be described.

Vulnerable Logic (Conceptual): The core logic in the main function of the vulnerable php.cgi binary operated as follows:

1. Receive the path information from the query string via the QUERY_STRING environment variable or as a command-line argument.
2. Directly use this user-controlled string as the path argument for a file open operation (e.g., fopen()).
3. Read the content of the opened file.
4. If the content is a PHP script, parse it. If not, output the content as-is.
5. There were no security checks to sanitize the input path, such as canonicalizing the path to resolve ../ sequences or checking if the final path resided within a permitted base directory (doc_root).

Patched Logic (Conceptual): Modern PHP and patched versions (3.0.10+) introduced critical security controls:

1. The input path is canonicalized to resolve all relative path components (. and ..).
2. The resulting absolute path is checked to ensure it falls within the boundaries of the configured document root or other open_basedir restrictions.
3. If the path is determined to be outside the allowed directories, the request is denied, and a permission error is logged.
4. Furthermore, the entire CGI architecture has been largely replaced by more secure models like mod_php for Apache or PHP-FPM, which have different and more robust request handling mechanisms.

Exploitation & Lab Setup

Exploitation is trivial and can be performed with a standard web browser or a command-line tool like curl.

Proof-of-Concept (PoC): An attacker can use curl to send a crafted request to a vulnerable server to retrieve the /etc/passwd file.

# Using an absolute path
curl "http://<target_ip>/cgi-bin/php.cgi?/etc/passwd"

# Using path traversal
curl "http://<target_ip>/somedir/php.cgi?../../../../etc/passwd"

A successful exploit will return the contents of the /etc/passwd file in the HTTP response body.

Lab Setup (Hypothetical): Recreating a vulnerable environment is complex and dangerous. It should only be done in a fully isolated, virtualized network.

1. OS: Install a period-appropriate Linux distribution (e.g., Red Hat Linux 5.2, Slackware 4.0).
2. Web Server: Compile and install an old version of Apache, such as Apache 1.3.x.
3. PHP: Download the source code for a vulnerable PHP version (e.g., PHP 3.0.9) and compile it with CGI support.
4. Configuration: Configure Apache to handle requests using the php.cgi binary via ScriptAlias or a similar directive.
5. Execution: Run the PoC curl command against the lab server's IP address.

Detection Engineering

Blue teams can detect exploitation attempts by monitoring web server logs and network traffic for characteristic patterns.

Suricata Rule: This rule detects attempts to use php.cgi to access common sensitive system files or employ path traversal techniques.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER CVE-1999-0238 PHP.CGI Arbitrary File Read Attempt"; flow:to_server,established; http.uri; content:"/php.cgi?"; fast_pattern; pcre:"/\/php\.cgi\?([^\r\n]*(\/etc\/passwd|\/etc\/shadow|win\.ini)|.*(%2e%2e(\/|%2f|\%5c)|..(\/|%2f|\%5c)))/i"; reference:cve,1999-0238; classtype:web-application-attack; sid:2000329; rev:11;)

SIEM Log Query (Generic): This query can be adapted for Splunk, Elasticsearch, or other SIEM platforms to find suspicious entries in web access logs.

SELECT source_ip, request_url, response_code
FROM web_logs
WHERE request_url LIKE '%/php.cgi?%'
  AND (
    request_url LIKE '%../%' OR
    request_url LIKE '%..\%' OR
    request_url LIKE '%/etc/%'
  )

Remediation & Mitigation

Given the extreme age of the affected software and its "UNPATCHED" status, standard patching is not an option. The only viable solution is a complete system overhaul.

• Primary Remediation: Decommission or Upgrade The only acceptable course of action is to immediately decommission any server running PHP 2.x or 3.x. The entire software stack (OS, web server, PHP) is end-of-life, unsupported, and riddled with countless other critical vulnerabilities. A full migration to a modern, supported platform (e.g., a recent Linux distribution with current versions of Apache/Nginx and PHP 8.x) is mandatory.

• Temporary Mitigation (Not a substitute for remediation): If immediate decommissioning is impossible, the following stop-gap measures can reduce, but not eliminate, the risk. These are temporary and should be treated with extreme caution.

  1. Web Application Firewall (WAF): Implement a WAF with rules specifically designed to block path traversal attacks and requests for sensitive file paths in URI strings.
  2. Disable CGI: If possible, disable the Apache CGI module (mod_cgi) or any other mechanism used to execute php.cgi.
  3. URL Rewriting: Use Apache's mod_rewrite to create a strict whitelist of allowed inputs to php.cgi, and block any request that deviates. This is complex and prone to bypass. An example rule would be to deny any request containing .. or /etc/.

     RewriteEngine On
     RewriteCond %{QUERY_STRING} \.\. [OR]
     RewriteCond %{QUERY_STRING} /etc/
     RewriteRule ^/cgi-bin/php\.cgi$ - [F,L]
     

These mitigations are fragile. The fundamental insecurity of the underlying platform remains, and attackers will likely find other vectors for compromise. The primary goal must be a full system upgrade.

[!] This Threat Intelligence report was automatically generated by Valters IT (valtersit.com) Neural Engine.

{/* [Security Hash: 809DE6FF8487AC67CC35FBDA] */}

source: https://www.securityfocus.com/bid/2250/info

PHP/FI is an software suite designed to offer enhanced features to sites served via the World Wide Web. It is open source, freely available, and maintained by the PHP development team.

A problem with the software could allow remote users access to restricted resources. Due to a design problem in the software package, the PHP/FI software package allows a remote user to browse directories and view files stored on the local host. It is possible to view only those files which the UID of the local httpd process has access to read. A user with malicious intent could use this vulnerability to gather information on the local host, and possibly gain remote access to encrypted user passwords on a system not using the shadow password suite.

http://www.someurl.com/php.cgi?/path/to/file