CVE-2020-7059

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

An Out-of-Bounds Read vulnerability (CVE-2020-7059) has been identified in php_strip_tags_ex(), the tag-stripping routine behind fgetss() and the string.strip_tags stream filter, which allows an attacker who controls data an application reads this way to make PHP read memory outside the buffer being processed. PHP tracks this issue as bug #79099.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.2.27, PHP 7.3 before 7.3.14 and PHP 7.4 before 7.4.2, which includes the End-of-Life PHP 5.6, 7.0 and 7.1 release lines through their final releases (5.6.40, 7.0.33 and 7.1.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <7.2.27, >=7.3.0 <7.3.14, >=7.4.0 <7.4.2
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.27, 7.3.14, 7.4.2
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the standard extension of all PHP versions before 7.2.27, 7.3 before 7.3.14 and 7.4 before 7.4.2, including the End-of-Life PHP 5.6, 7.0 and 7.1 release lines, which never received the upstream fix. The PHP project scores it 6.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

fgetss() (and SplFileObject::fgetss()) reads a line from a stream and removes HTML and PHP tags from it, and the string.strip_tags stream filter does the same to data as it passes through a stream. Both call php_strip_tags_ex(), a small state machine that walks the input one character at a time. Unlike strip_tags(), these callers keep the parser state between calls, so a new chunk of input can start in the middle of a tag. Several branches of the state machine look at neighboring characters without checking that they are inside the buffer. In PHP 5.6.40, for example:

case '!':
    /* JavaScript & Other HTML scripting languages */
    if (state == 1 && *(p-1) == '<') {
        state = 3;
        lc = c;

When such a character is the first one of the buffer, *(p-1) reads the byte before the buffer. The reporter found the out-of-bounds read with AddressSanitizer while fuzzing SplFileObject::fgetss(). HeroDevs' analysis confirms that PHP 5.6 can read outside the buffer through both fgetss() and the string.strip_tags filter. The CVE record describes the impact as possible information disclosure or a crash.

Exploitation needs an application that reads untrusted data with fgetss() or through the string.strip_tags stream filter, for example to sanitize an uploaded or fetched file. This works in any SAPI. Applications that do not use these functions are not affected.

The fix bounds each of these checks by the start of the buffer:

case '!':
    /* JavaScript & Other HTML scripting languages */
    if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
        state = 3;
        lc = c;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid fgetss() and the string.strip_tags stream filter on untrusted data.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.27, 7.3.14, 7.4.2, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• wxhusst (finder)
• Stanislav Malyshev (remediation)