CVE-2019-11043 PoC — Underflow in PHP-FPM can lead to RCE

Source

https://github.com/0th3rs-Security-Team/CVE-2019-11043

Associated Vulnerability

Title:Underflow in PHP-FPM can lead to RCE (CVE-2019-11043)
Description:In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Description

CVE-2019-11043  PHP7.x  RCE

Readme

# CVE-2019-11043

### 0th3rs Security Team
#### ======================
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11

Tested under PHP 7.2.20/7.3.10

#### Instructions
```
1、较为稳定,只要爆破出query长度和Header头字段长度
2、auto_session检测漏洞存在性
3、实现判断目标worker进程数实现健壮性
4、全worker进程污染
```

#### Nginx configuration
```
location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    include fastcgi_params;

    fastcgi_param   PATH_INFO       $fastcgi_path_info;
    fastcgi_param SCRIPT_FILENAME   $document_root$fastcgi_script_name;
    fastcgi_param PATH_TRANSLATED   $document_root$fastcgi_path_info;
    fastcgi_pass 127.0.0.1:9000;

```

#### Usage:
```
python cve_2019_11043.py -u http://xxxx/index.php
```

File Snapshot


 [4.0K]  /data/pocs/8b2d9367e0b7db9e4c1a7d3dfedf8062c51e613a
├── [4.7K]  cve_2019_11043.py
└── [ 835]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!