{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-11043/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-11043/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-11043/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-11043/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-11043/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-11043"},"sightings":{"href":"/api/v1/sightings/cve-2019-11043"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.9978,"kev":true,"percentile":0.99956},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-11043.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2019-11043\n\ninfo:\n  name: PHP-FPM Path Info Buffer Underflow - Remote Code Execution\n  author: Prasath from Securin Labs (https://securin.io)\n  severity: critical\n  description: |\n    In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation.\n  remediation: |\n    Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later. As mitigation, remove the fastcgi_split_path_info directive or ensure it cannot match an empty PATH_INFO.\n  reference:\n    - https://bugs.php.net/bug.php?id=78599\n    - https://github.com/neex/phuip-fpizdam\n    - https://www.nginx.com/blog/nginx-php-fastcgi-process-manager/\n    - https://security.netapp.com/advisory/ntap-20191031-0001/\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-11043\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-11043\n    cwe-id: CWE-119\n    epss-score: 0.9978\n    epss-percentile: 0.99957\n    cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: php\n    product: php\n    shodan-query: title:\"PHP\" port:80,443\n    fofa-query: app=\"PHP\"\n  tags: cve,cve2019,php,php-fpm,nginx,rce,fastcgi,kev,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /index.php/%0a HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /index.php/%0atest HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: php_version\n        part: header\n        group: 1\n        regex:\n          - \"(?i)X-Powered-By:\\\\s*PHP/([0-9]+\\\\.[0-9]+\\\\.[0-9]+)\"\n        internal: true\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        part: header\n        status:\n          - 200\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"X-Powered-By: PHP\"\n          - \"x-powered-by: php\"\n        condition: or\n        case-insensitive: true\n\n      - type: regex\n        part: header\n        regex:\n          - \"(?i)X-Powered-By:\\\\s*PHP/(7\\\\.(0|1|2|3)\\\\.[0-9]+|5\\\\.[0-9]+\\\\.[0-9]+)\"\n\n      - type: dsl\n        dsl:\n          - |\n            compare_versions(php_version, \">= 7.0.0\", \"< 7.1.33\") ||\n            compare_versions(php_version, \">= 7.2.0\", \"< 7.2.24\") ||\n            compare_versions(php_version, \">= 7.3.0\", \"< 7.3.11\")\n# digest: 4a0a0047304502207f994060ec386cb7af5e8728d94789bb9787d85269206703f1da28c779415c22022100fce7533758f3a16608110d8facb5b40859dca37b8e19a7bb3282cc970daea8d4:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2019-11043"}