CVE-2025-7381

Executive Summary

CVE-2025-7381 is a low-severity information disclosure vulnerability affecting PHP’s base image configuration. By default, PHP sends an X-Powered-By HTTP response header that reveals the exact PHP version running on the server. An attacker can use this header to fingerprint the server and identify potentially vulnerable PHP versions, aiding in targeted exploitation. The vulnerability is trivially mitigated by setting expose_php = Off in the PHP configuration file (php.ini). No patch is required, as this is a configuration hardening issue.

Supply Chain & Package Security

This vulnerability is not specific to a package manager (NPM, PyPI, Go, Ruby) but affects the PHP runtime environment itself. It is relevant to any containerized or server-based PHP deployment, including those using official PHP Docker images.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (PHP version disclosure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. The vulnerability only exposes the PHP version, not sensitive data. However, it can be a stepping stone for more targeted attacks.

Deep Dive & Mechanics

The expose_php directive in php.ini controls whether PHP adds the X-Powered-By header to HTTP responses. When set to On (the default), the header includes the PHP version, e.g., X-Powered-By: PHP/8.1.2. This header is sent in every response generated by PHP, including error pages and normal content.

An attacker can:

1. Send a simple HTTP request to any PHP endpoint.
2. Inspect the response headers for X-Powered-By.
3. Extract the exact PHP version (e.g., 8.1.2).
4. Cross-reference with known CVEs for that version to plan further attacks.

This is a passive reconnaissance technique, often used in the initial stages of an attack.

Vulnerable vs. Patched Code

Vulnerable Configuration (default):

; php.ini
expose_php = On

Patched/Mitigated Configuration:

; php.ini
expose_php = Off

No code changes are needed; only configuration changes.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a PHP application using the default PHP Docker image (e.g., php:8.1-apache).
2. Reconnaissance:

   curl -I http://target-php-app.local/
   

   Expected response header:

   HTTP/1.1 200 OK
   X-Powered-By: PHP/8.1.2
   

3. Fingerprinting: Extract the version and search for known vulnerabilities (e.g., CVE-2023-XXXX for PHP 8.1.2).
4. Exploitation: Use the version info to launch targeted attacks (e.g., RCE, LFI) based on known CVEs.

Blue Team (Defense & Detection)

1. Mitigation: Set expose_php = Off in php.ini and restart the web server.
2. Detection: Monitor for unexpected X-Powered-By headers in outbound responses.
3. Honeypot: Deploy a decoy PHP server with expose_php = On to detect reconnaissance attempts.

Indicators of Compromise (IOCs)

• Network: HTTP responses containing X-Powered-By: PHP/ header.
• Logs: Web server access logs showing requests to non-existent PHP files (e.g., GET /test.php) followed by version-specific exploit attempts.
• File System: Presence of php.ini with expose_php = On (default).

Detection Engineering

YARA Rule

rule Detect_PHP_Version_Disclosure {
    meta:
        description = "Detects HTTP responses containing X-Powered-By header with PHP version"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "low"
    strings:
        $header = "X-Powered-By: PHP/" nocase
    condition:
        $header
}

Sigma Rule

title: PHP Version Disclosure via X-Powered-By Header
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing the X-Powered-By header with PHP version information.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        response_header|contains: "X-Powered-By: PHP/"
    condition: selection
falsepositives:
    - Legitimate PHP applications that intentionally expose version for debugging
level: low

Suricata Rule

alert http any any -> any any (msg:"PHP Version Disclosure via X-Powered-By Header"; flow:to_client; content:"X-Powered-By: PHP/"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Set expose_php = Off in /usr/local/etc/php/php.ini (or the appropriate path) and restart the web server.
2. Containerized Environments: Update Dockerfiles to include:

   RUN echo "expose_php = Off" >> /usr/local/etc/php/php.ini
   

3. Web Server Hardening: Use .htaccess or server config to remove the header:
   • Apache: Header unset X-Powered-By
   • Nginx: proxy_hide_header X-Powered-By;
4. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on exposed headers.
5. Long-term: Adopt a security baseline for PHP configurations and enforce via CI/CD pipelines.

Valters IT
Securing digital frontiers, one configuration at a time.