CVE-2018-19395

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. On Windows, its com_dotnet extension lets scripts create and call COM and .NET objects through the COM, DOTNET and VARIANT classes.

A Denial of Service (DoS) vulnerability (CVE-2018-19395) has been identified in the object handlers of PHP's com_dotnet extension on Windows, which allows an attacker who can make an application serialize, export or otherwise read the properties of a COM, DOTNET or VARIANT object to crash the PHP process. PHP tracks this issue as bug #77177.

Per MITRE CWE-476: The product dereferences a pointer that it expects to be valid but is NULL.

This issue affects PHP 5.x, PHP 7.0 and PHP 7.1 through their final releases (5.6.40, 7.0.33 and 7.1.33), PHP 7.2 before 7.2.14 and PHP 7.3.0, on Windows.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/com_dotnet)
• Affected versions: >=5.0.0 <=7.1.33, >=7.2.0 <7.2.14, >=7.3.0 <7.3.1 (Windows only)
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.14, 7.3.1
  • NES for PHP 5.6.2 (based on PHP 5.6.40)

Vulnerability Info

This High-severity vulnerability is found in the com_dotnet extension of PHP 5.x, 7.0 and 7.1 through their final releases, 7.2 before 7.2.14 and 7.3.0 on Windows; the End-of-Life PHP 5.6, 7.0 and 7.1 release lines never received the upstream fix. The CVE record, assigned by MITRE, has no CVSS score and no CWE; NVD scores it 7.5 under CVSS 3.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is a NULL pointer dereference that ends in a crash (denial of service).

Every PHP object has a get_properties handler that the engine and functions such as serialize(), var_export() and an (array) cast call to obtain the object's property table. The com_dotnet extension never implemented a property table for its objects; its handler returns NULL. In PHP 5.6.40 it reads:

static HashTable *com_properties_get(zval *object TSRMLS_DC)
{
    /* TODO: use type-info to get all the names and values ?
     * DANGER: if we do that, there is a strong possibility for
     * infinite recursion when the hash is displayed via var_dump().
     * Perhaps it is best to leave it un-implemented.
     */
    return NULL;
}

The callers expect a valid table and do not check for NULL. The reporter showed that calling serialize() on a COM("WScript.Shell") object crashes PHP when it counts the object's properties, and that unserialize() of a COM object crashes as well (tracked separately as CVE-2018-19396). HeroDevs' analysis confirms that on PHP 5.6 the same NULL table is dereferenced by var_export(), serialize() and casting a COM, DOTNET or VARIANT object to an array.

Exploitation needs a Windows build of PHP with the com_dotnet extension loaded and an application that passes a COM, DOTNET or VARIANT object to one of these functions, for example by serializing data that can contain such an object. The result is a crash of the PHP process or worker that handles the request. The com_dotnet extension is built only on Windows, so PHP on Linux and other platforms is not affected.

The upstream fix makes the handler return an empty property table instead of NULL, which already prevents the crashes, and additionally refuses to serialize or unserialize COM, DOTNET and VARIANT objects. After the fix, the handler ends with:

    return &com_dotnet_object_properties;
}

The NES for PHP 5.6 fix likewise gives these objects an empty property table of their own, so code that reads their properties no longer dereferences NULL.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not serialize, export or cast to array any value that can hold a COM, DOTNET or VARIANT object, or disable the com_dotnet extension where it is not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.14, 7.3.1, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• zsxsoft (finder)
• Christoph M. Becker (remediation)