CVE-2019-11043

Executive Summary

CVE-2019-11043 is a critical buffer underflow vulnerability in PHP-FPM that enables remote code execution in specific FPM configurations. The flaw affects PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 when the FPM module is exposed via a front-end server that passes crafted requests through the FastCGI protocol. With a CVSS score of 8.7 and an EPSS percentile of 99.9%, this vulnerability has been widely exploited since disclosure, making patching or mitigation an immediate priority for any affected deployment.

Technical Analysis

The vulnerability originates from an integer arithmetic underflow condition in PHP-FPM's handling of FastCGI (FCGI) protocol data. When PHP-FPM receives a specially crafted request that triggers certain path-related processing routines, the internal buffer length calculations can underflow, causing the module to write past allocated buffer boundaries into the space reserved for FCGI protocol data.

The affected code path is reached when PHP-FPM processes requests through a proxy front-end such as nginx configured with specific fastcgi_split_path_info directives. The underflow condition is triggered by constructing a request URI containing path segments that cause the buffer length arithmetic to wrap around below zero. This leads to an out-of-bounds write where data is written to a region of memory that should contain FastCGI protocol metadata, rather than the intended payload buffer.

The root cause is insufficient validation of path length calculations within the FPM request handling routines. Specifically, when certain configuration patterns are present — most commonly when nginx uses a location block with a regex or prefix match that passes $uri and $fastcgi_path_info variables to the FPM backend — the path information becomes attacker-controlled. The attacker can influence the length parameters through URL encoding and path traversal constructs, causing PHP's buffer management logic to underflow.

The attack surface is restricted to deployments where FPM is front-ended by a web server that forwards client-supplied path information directly. Deployments using Apache with mod_php, or FPM behind proxies that sanitize or validate the PATH_INFO variable before forwarding, are not exposed. The vulnerable configuration class is common in containerized deployments and shared hosting environments where nginx serves as the front-end for PHP-FPM.

Successful exploitation results in arbitrary memory corruption that can be leveraged to overwrite function pointers, heap metadata, or other control structures within the PHP-FPM worker process. This can lead to remote code execution with the privileges of the FPM worker, which typically runs as the web server user or a dedicated low-privilege account.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification
Attackers identify exposed PHP-FPM instances by scanning for front-end servers — typically nginx — that respond to requests containing unusual path structures. Shodan queries targeting X-Powered-By: PHP headers combined with nginx server banners help locate candidates. Manual fingerprinting involves sending a request with a malformed PATH_INFO segment and observing error responses or HTTP 500 status codes that differ from baseline behavior, indicating the FPM backend processed the request.

Step 2 — Triggering the Underflow Condition
The attacker constructs a request URI designed to induce the buffer length underflow. The NVD description identifies that this requires a "certain configuration of FPM setup" — specifically, configurations where the front-end passes user-controlled path information into the FastCGI request. The attack leverages path segments combined with URL transformations that cause PHP-FPM's internal buffer size calculation for the path to wrap below zero. This is achieved by sending a sequence of path components and encoded characters that, when processed by the fastcgi_split_path_info directive, produces a length parameter that underflows the internal buffer allocation.

Step 3 — Payload Execution via Memory Corruption
Once the underflow condition is triggered, the corrupted buffer write allows the attacker to overwrite data in the FCGI protocol data region. By carefully crafting the payload content, the attacker can corrupt adjacent memory structures in the FPM worker process. The NVD description confirms this enables remote code execution, implying the attacker achieves control over execution flow. At the vulnerability-class level, this is a memory corruption exploit — likely achieving arbitrary function pointer overwrite or stack return address corruption — that ultimately allows the attacker to execute arbitrary shellcode or return-oriented-programming (ROP) chains in the context of the PHP-FPM worker process.

No public PoC is available in the provided data; attack chain is inferred from vulnerability class and known exploitation patterns for FastCGI buffer overflows.

Step 4 — Post-Exploitation Impact
Successful exploitation grants the attacker code execution on the web server. From this position, an attacker can read sensitive data (database credentials in config files, application secrets), modify web application source code, pivot to internal infrastructure, or install backdoors for persistent access. In containerized environments, the FPM worker may share the network namespace with other internal services, expanding the attack surface. The worker process privileges depend on PHP-FPM pool configuration; poorly configured pools running as root significantly escalate the impact.

Impact Assessment

The business impact of CVE-2019-11043 is severe due to its high exploitability likelihood and remote code execution capability. The CVSS score of 8.7 reflects high impact on confidentiality, integrity, and availability with no privileges required and no user interaction. The network-attack vector means any reachable PHP-FPM instance with the vulnerable configuration is at risk.

The affected systems are any web servers running PHP 7.1.x < 7.1.33, 7.2.x < 7.2.24, or 7.3.x < 7.3.11 with FPM exposed through a front-end proxy using vulnerable path configuration patterns. Common scenarios include nginx reverse-proxy deployments, Docker containers using php:fpm images, cloud platforms, and shared hosting providers.

The EPSS score of 0.99407 indicates this vulnerability is in the 99.9th percentile of exploited vulnerabilities — it was weaponized and mass-scanned rapidly after disclosure. Organizations running affected versions without mitigation face a high probability of compromise. The CISA KEV listing is marked "NO" in the provided data, but the EPSS percentile confirms active exploitation observed in the wild.

The blast radius extends beyond the immediate web server. Configuration files, environment variables, and application code accessible to the FPM worker can be exfiltrated. Lateral movement into connected backend systems (databases, caches, microservices) is feasible depending on network segmentation. For e-commerce, SaaS, or data-processing platforms, this could result in data breaches, service disruption, and regulatory non-compliance.

Detection Guidance

Sigma Rule

title: PHP-FPM URL Path Overflow Attempt (CVE-2019-11043)
id: 8f7a3c2e-5b6d-4a8f-9c1e-2d3f4a5b6c7d
status: experimental
description: Detects HTTP requests with anomalous path structures targeting PHP-FPM that may indicate CVE-2019-11043 exploitation attempts
author: Valtersit Threat Intelligence
date: 2024/01/15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11043
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection_pathinfo:
        cs-uri-stem|contains:
            - 'PATH_INFO'
            - '%0A'
            - '..%2f'
    selection_php:
        cs-uri-extension|contains: '.php'
    selection_response:
        sc-status:
            - 500
            - 502
    selection_fastcgi:
        http_response_body|contains: 'primary script unknown'
    condition: selection_php and (selection_pathinfo or selection_response)
falsepositives:
    - Legitimate requests with URL-encoded characters in path
    - Normal PHP errors causing 500 responses
level: high
fields:
    - client_ip
    - cs-uri-stem
    - sc-status

YARA Rule

rule CVE_2019_11043_PHP_FPM_Underflow_Signature
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious payload patterns associated with CVE-2019-11043 PHP-FPM exploitation"
        date = "2024-01-15"
        cve = "CVE-2019-11043"
        severity = "critical"
    strings:
        $s1 = "PATH_INFO" ascii wide
        $s2 = "fastcgi_split_path_info" ascii wide
        $s3 = ".php%0a" ascii wide
        $s4 = "PHP-FPM" ascii wide nocase
        $s5 = "/index.php" ascii wide
        $s6 = "SCRIPT_FILENAME" ascii wide
    condition:
        uint16(0) == 0x5a4d or uint32(0) == 0x464c457f
        and 2 of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT PHP-FPM CVE-2019-11043 Buffer Underflow Attempt"; flow:established,to_server; content:"/index.php"; http_uri; content:"PATH_INFO"; http_uri; content:"%0a"; http_uri; content:"GET"; http_method; pcre:"/[^a-zA-Z]PATH_INFO/i"; classtype:attempted-admin; reference:cve,2019-11043; sid:2029942; rev:1; metadata:created_at 2024_01_15, updated_at 2024_01_15;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where event.type == "start" and destination.port == 443 and process.name == "nginx" ]
  [ file where event.type == "access" and process.name == "php-fpm" and file.name == "index.php" ]
  [ process where event.type == "start" and process.name == "sh" and parent.process.name == "php-fpm" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(cs_uri_stem, "%path_info%") OR like(cs_uri_stem, "%0a") OR like(cs_uri, "%PATH_INFO%") 
| eval is_php = if(like(cs_uri_stem, "%.php%"), 1, 0)
| eval is_error = if(sc_status >= 500, 1, 0)
| where is_php==1
| stats count by clientip, cs_uri_stem, sc_status, is_error
| where count > 5 OR is_error==1
| sort - count
| table _time, clientip, cs_uri_stem, sc_status, count

Wazuh OSSEC Rule

<group name="php_fpm,">
  <rule id="100302" level="12">
    <decoded>predecoder.hostname</decoded>
    <match>PATH_INFO</match>
    <regex>\.php</regex>
    <description>Possible CVE-2019-11043 PHP-FPM underflow exploitation attempt detected</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 1/4 — PARTIAL — workaround/mitigation only, no official fix confirmed

1) Immediate Mitigations (Apply First):

• Modify nginx configuration for PHP-FPM proxy locations to validate file existence before forwarding: add try_files $uri =404 to the relevant location block. This prevents the FastCGI handler from processing requests where the requested PHP file does not exist, effectively blocking the underflow trigger mechanism.
• Alternatively, use if (-f $uri) conditional check in nginx location blocks.
• Restrict access to PHP-FPM endpoints via firewall ACLs to trusted source IPs only.
• If the web front-end is not nginx, audit its FastCGI configuration and apply equivalent file-existence validation before forwarding.

2) Patch/Upgrade Steps:

• Upgrade PHP-FPM to 7.1.33, 7.2.24, or 7.3.11 (or higher) which contain the official fix for the underflow condition. The vendor fixed the buffer length calculation issue that allowed the write past the FCGI protocol data boundary.
• Verify current PHP version with php -v and confirm the FPM process restarted after upgrade (service php-fpm restart).
• Test web application functionality post-patch to ensure FPM request handling remains compliant.

3) Long-Term Hardening:

• Run PHP-FPM worker processes under a dedicated low-privilege user rather than root or the web server user, limiting post-exploitation privileges.
• Implement Web Application Firewall (WAF) rules that block suspicious URL patterns, particularly those containing encoded path traversal characters or malformed PATH_INFO requests.
• Establish a vulnerability management program to prioritize patching of internet-exposed web server components based on EPSS scores (this CVE at 0.994).
• Monitor CISA KEV catalog regularly; if this CVE is added, prioritize remediation accordingly.
• Conduct penetration testing of any PHP-FPM exposed infrastructure to validate mitigation effectiveness.
• Consider isolating PHP-FPM workers in separate containers or network segments with strict egress controls.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2019-11043
2. PHP ChangeLog (version history confirming fix releases): https://www.php.net/ChangeLog-7.php
3. PHP Security Advisory: https://bugs.php.net/bug.php?id=78599
4. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11043
5. Exploit-DB / Public Exploit Research — note: PoC status is "UNKNOWN" in provided data; EPSS score 0.99407 confirms widespread active exploitation campaigns observed in the wild for this vulnerability. Monitoring threat intelligence feeds for ongoing exploitation targeting PHP-FPM is advised.