Vulnerability Details : CVE-2019-11043

Public exploit exists!
Used for ransomware!
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Published 2019-10-28 15:15:14
Updated 2024-07-16 17:52:59
Source PHP Group
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2019-11043

Threat overview for CVE-2019-11043

Top countries where our scanners detected CVE-2019-11043
Top open port discovered on systems with this issue 80
IPs affected by CVE-2019-11043 171,989
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2019-11043!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

CVE-2019-11043 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2019-11043
Added on 2022-03-25 Action due date 2022-04-15

Exploit prediction scoring system (EPSS) score for CVE-2019-11043

EPSS FAQ
96.86%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-11043

  • PHP-FPM Underflow RCE
    Disclosure Date: 2019-10-22
    First seen: 2020-04-26
    exploit/multi/http/php_fpm_rce
    This module exploits an underflow vulnerability in versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 of PHP-FPM on Nginx. Only servers with certains Nginx + PHP-FPM configurations are exploitable. This is a port of the original neex's exp

CVSS scores for CVE-2019-11043

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST
8.7
 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
2.2
5.8
 PHP Group

CWE ids for CVE-2019-11043

References for CVE-2019-11043

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close