CVE-2019-11043

HIGH(8.7)KEVRansomwareLikely Exploited

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Description

CVE-2019-11043 is a buffer overflow vulnerability in PHP-FPM (FastCGI Process Manager) that can lead to remote code execution when PHP-FPM is used with certain nginx configurations. The flaw allows an unauthenticated attacker to execute arbitrary code on the web server by sending specially crafted HTTP requests. This vulnerability is particularly dangerous because the affected nginx+PHP-FPM combination is one of the most common web server deployments. It was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, and with an EPSS score of 97.4% (99.9th percentile), exploitation is near-certain.

KEV Information

Vendor
PHP
Product
FastCGI Process Manager (FPM)
Date Added
March 25, 2022
Due Date
April 15, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
5.8

CWEs

CWE-120Classic Buffer Overflow

Buffer Copy without Checking Size of Input

CWE-787Out-of-bounds Write

Out-of-bounds Write

Affected Products

VendorProductVersion
phpphp>= 7.1.0, < 7.1.33; >= 7.2.0, < 7.2.24; >= 7.3.0, < 7.3.11
canonicalubuntu linux12.04; 14.04; 16.04; 18.04; 19.04; 19.10
debiandebian linux9.0; 10.0
fedoraprojectfedora29; 30; 31
tenabletenable.sc< 5.19.0
redhatsoftware collections1.0
redhatenterprise linux8.0
redhatenterprise linux desktop6.0; 7.0
redhatenterprise linux eus7.7; 8.1; 8.2; 8.4; 8.6; 8.8
redhatenterprise linux eus compute node7.7
redhatenterprise linux for arm 648.0_aarch64
redhatenterprise linux for arm 64 eus8.1_aarch64; 8.2_aarch64; 8.4_aarch64; 8.6_aarch64; 8.8_aarch64
redhatenterprise linux for ibm z systems6.0_s390x; 7.0_s390x; 8.0_s390x
redhatenterprise linux for ibm z systems eus7.7_s390x; 8.1_s390x; 8.2_s390x; 8.4_s390x; 8.6_s390x; 8.8_s390x
redhatenterprise linux for power big endian6.0_ppc64; 7.0_ppc64
redhatenterprise linux for power big endian eus7.7_ppc64
redhatenterprise linux for power little endian7.0_ppc64le; 8.0_ppc64le
redhatenterprise linux for power little endian eus7.7_ppc64le; 8.1_ppc64le; 8.2_ppc64le; 8.4_ppc64le; 8.6_ppc64le; 8.8_ppc64le
redhatenterprise linux for scientific computing7.0
redhatenterprise linux server6.0; 7.0

Multiple CVSS Assessments

Source: [email protected](Secondary)
8.7
HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

CVE-2019-11043 is classified under CWE-120, which describes vulnerabilities where data is copied to a buffer without verifying that the data size does not exceed the buffer's capacity. In PHP-FPM, the FCGI protocol handler contains a buffer overflow in the way it processes certain path information, allowing an attacker to overwrite adjacent memory and ultimately achieve code execution.

Learn more: CWE-120 — Buffer Copy without Checking Size of Input

Impact Analysis

CVE-2019-11043 allows unauthenticated remote attackers to achieve code execution on web servers running vulnerable PHP-FPM configurations with nginx. The attacker can execute arbitrary PHP code or system commands with the privileges of the PHP-FPM worker process, which can lead to complete web application compromise, access to databases and backend services, reading sensitive configuration files and credentials, and establishing persistent backdoor access. The vulnerability specifically affects nginx configurations that use a common but insecure fastcgi_split_path_info directive pattern. The EPSS score of 97.4% confirms near-certain exploitation, and the prevalence of nginx+PHP-FPM deployments makes the potential attack surface extremely large.

Exploit Maturity

CVE-2019-11043 has been confirmed as actively exploited in the wild by CISA. A well-known public exploit tool called 'phuip-fpizdam' was released shortly after disclosure, making exploitation trivial. The exploit has been integrated into multiple penetration testing frameworks and is actively used in automated scanning campaigns. With an EPSS score of 97.4% (99.9th percentile), exploitation is near-certain for any exposed vulnerable configuration.

Remediation

  1. Update PHP: Upgrade to PHP 7.3.11, 7.2.24, or later versions that contain the fix for CVE-2019-11043.
  2. Fix nginx configuration: Review and update nginx configurations to avoid the vulnerable fastcgi_split_path_info pattern. Ensure the PATH_INFO variable is properly validated before being passed to PHP-FPM.
  3. Add path validation in nginx: Add a try_files directive or equivalent validation to ensure only existing PHP files are processed by PHP-FPM.
  4. Monitor for exploitation attempts: Review web server access logs for unusual URL patterns with crafted path components targeting PHP-FPM endpoints.
  5. Implement a Web Application Firewall: Deploy WAF rules to detect and block requests containing buffer overflow patterns targeting the PHP-FPM path handler.

Technical Details

CVE-2019-11043 is a buffer overflow vulnerability in the FCGI request handler of PHP-FPM. The vulnerability is triggered in specific nginx configurations where the fastcgi_split_path_info directive uses a regular expression that can result in an empty PATH_INFO value. When nginx passes this crafted request to PHP-FPM, the FCGI protocol handler in PHP-FPM mishandles the path information, leading to a buffer underflow that allows an attacker to overwrite the FCGI protocol data in memory. By carefully crafting the URL, an attacker can manipulate PHP-FPM's internal state to include arbitrary PHP code in the request processing, resulting in remote code execution. The vulnerable nginx configuration pattern typically looks like fastcgi_split_path_info ^(.+?\.php)(/.*)$; without proper path validation.

Frequently Asked Questions

Is CVE-2019-11043 being actively exploited?

Yes. CISA has confirmed active exploitation, and a public exploit tool called 'phuip-fpizdam' makes exploitation trivial. The EPSS score of 97.4% confirms near-certain exploitation for vulnerable configurations.

What products are affected by CVE-2019-11043?

CVE-2019-11043 affects PHP-FPM versions prior to 7.3.11 and 7.2.24 when used with nginx in specific configurations that use the fastcgi_split_path_info directive with certain regex patterns.

How do I fix CVE-2019-11043?

Update PHP to version 7.3.11, 7.2.24, or later. Additionally, review and fix the nginx configuration to properly validate paths before passing requests to PHP-FPM, such as adding a try_files directive.

How severe is CVE-2019-11043?

CVE-2019-11043 is a critical remote code execution vulnerability. The nginx+PHP-FPM stack is one of the most common web server deployments, making the potential attack surface extremely large. Unauthenticated exploitation with a public tool makes this a top-priority vulnerability.

CVSS Score

8.7
HIGH(8.7)

EPSS Score

EPSS Score99.41%
EPSS Percentile99.9%

Dates

PublishedOctober 28, 2019
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch