CVE-2019-11039

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its iconv extension converts text between character sets and provides iconv_mime_decode() and iconv_mime_decode_headers() for decoding MIME-encoded mail headers.

An Out-of-Bounds Read vulnerability (CVE-2019-11039) has been identified in _php_iconv_mime_decode(), the parser behind iconv_mime_decode() and iconv_mime_decode_headers(), which allows an attacker who supplies a crafted MIME header to make PHP read past the end of the header buffer and copy that memory into the decoded result, which can disclose memory contents or crash the process. PHP tracks this issue as bug #78069.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.1.30, PHP 7.2 before 7.2.19 and PHP 7.3 before 7.3.6, including the End-of-Life release lines PHP 5.6 and 7.0 through their final releases (5.6.40 and 7.0.33), which carry the same code.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/iconv)
• Affected versions: <7.1.30, >=7.2.0 <7.2.19, >=7.3.0 <7.3.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.30, 7.2.19, 7.3.6
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the iconv extension of PHP before 7.1.30, 7.2 before 7.2.19 and 7.3 before 7.3.6, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.2 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L).

_php_iconv_mime_decode() walks the header in a loop that counts the remaining bytes down in str_left, a size_t, and stops when it reaches zero. When an encoded word names a character set iconv does not know and the caller passed ICONV_MIME_DECODE_CONTINUE_ON_ERROR, the parser copies the encoded word through undecoded and skips to its end. In PHP 5.6.40 that code reads:

int qmarks = 2;
while (qmarks > 0 && str_left > 1) {
    if (*(++p1) == '?') {
        --qmarks;
    }
    --str_left;
}

/* Look ahead to check for the terminating = that
 * should be there as well; if it's there, we'll
 * also include that. If it's not, there isn't much
 * we can do at this point. */
if (*(p1 + 1) == '=') {
    ++p1;
    --str_left;
}

The while loop stops with str_left at 1 when it reaches the end of the input. If the last byte is the closing =, the look-ahead decrements str_left to 0, and the outer loop then decrements it once more before checking it. Because str_left is unsigned, it wraps to a very large value, and the parser keeps reading past the end of the header and copying those bytes into the decoded string. Depending on what follows the buffer, the result is a crash or a decoded header that contains memory from outside it.

Exploitation needs an application that decodes MIME headers an attacker supplies, such as a mail-processing script, using the continue-on-error mode. Any SAPI is affected. PHP 5.6 contains the same code, and NES for PHP 5 carries the fix.

The fix only decrements str_left for the closing = while input remains, so the counter can no longer wrap:

if (*(p1 + 1) == '=') {
    ++p1;
    if (str_left > 1) {
        --str_left;
    }
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.30, 7.2.19, 7.3.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• maris.adam (finder)
• Stanislav Malyshev (remediation)