CVE-2018-19396

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. On Windows, its com_dotnet extension exposes COM and .NET components to PHP scripts through the com, dotnet and variant classes.

A Denial of Service (DoS) vulnerability (CVE-2018-19396) has been identified in the handling of com, dotnet and variant objects by unserialize() on Windows, which allows an attacker who can pass serialized data to an application's unserialize() call to crash the PHP process. PHP tracks this issue as bug #77177.

Per MITRE CWE-476: The product dereferences a pointer that it expects to be valid but is NULL.

This issue affects all versions of PHP before 7.2.14 and PHP 7.3.0 on Windows.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/com_dotnet, ext/standard)
• Affected versions: <7.2.14, >=7.3.0 <7.3.1 (Windows only)
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.14, 7.3.1
  • NES for PHP 5.6.2 (based on PHP 5.6.40)

Vulnerability Info

This High-severity vulnerability is found in the com_dotnet extension, which is only built for Windows, of all PHP versions before 7.2.14 and of PHP 7.3.0, including the End-of-Life PHP 5.6, 7.0 and 7.1 release lines, which never received the upstream fix. The CVE record was assigned by MITRE and carries no CVSS score, and CISA-ADP has not added one; NVD scores it 7.5 under CVSS 3.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The com_dotnet extension registers the variant class and its subclasses com and dotnet. Their objects wrap a Windows COM value and have no PHP property table. The extension's get_properties handler reflects that by returning NULL. In PHP 7.1.24 it reads:

static HashTable *com_properties_get(zval *object)
{
    /* TODO: use type-info to get all the names and values ?
     * DANGER: if we do that, there is a strong possibility for
     * infinite recursion when the hash is displayed via var_dump().
     * Perhaps it is best to leave it un-implemented.
     */
    return NULL;
}

unserialize() in ext/standard/var_unserializer.c creates an object of whatever class the serialized string names and then fills in its properties through the object's property table. For these three classes nothing stopped that, so the unserializer received a NULL table and dereferenced it, which crashes the process. The reporter showed the same crash when serialize() is called on a COM object. No COM component has to be instantiated by the application for the unserialize() crash: the class name in the serialized data is enough.

Exploitation needs a Windows build of PHP with com_dotnet loaded (the php_com_dotnet.dll extension) and an application that passes attacker-controlled data to unserialize(). The attacker can then crash the worker or process handling the request, and repeated requests can keep a site unavailable. HeroDevs' analysis confirms that the Linux builds of PHP do not contain ext/com_dotnet and are not affected.

The fix, by Christoph M. Becker, makes the property handler return an empty table instead of NULL, and marks all three classes as not serializable, so serialize() and unserialize() refuse them with an exception instead of crashing. In upstream PHP the class registration now reads:

INIT_CLASS_ENTRY(ce, "com", NULL);
ce.create_object = php_com_object_new;
tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
tmp->get_iterator = php_com_iter_get;
tmp->serialize = zend_class_serialize_deny;
tmp->unserialize = zend_class_unserialize_deny;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not pass untrusted data to unserialize(), and on Windows servers that do not use COM or .NET from PHP, stop loading the com_dotnet extension in php.ini.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.14, 7.3.1, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• zsxsoft (finder)
• Christoph M. Becker (remediation)