CVE-2020-7062

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its session extension can track the progress of file uploads in the user's session, so that a page can report how much of a large upload has arrived.

A Denial of Service (DoS) vulnerability (CVE-2020-7062) has been identified in the upload progress handler of PHP's session extension, which allows a remote, unauthenticated client to crash the PHP worker that handles its request by sending a crafted multipart upload when upload progress tracking is enabled and its automatic cleanup is disabled. PHP tracks this issue as bug #79221.

Per MITRE CWE-476: The product dereferences a pointer that it expects to be valid but is NULL.

This issue affects PHP 7.2 before 7.2.28, PHP 7.3 before 7.3.15 and PHP 7.4 before 7.4.3, as well as the End-of-Life release lines PHP 5.6, 7.0 and 7.1 through their final releases (5.6.40, 7.0.33 and 7.1.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/session)
• Affected versions: <7.2.28, >=7.3.0 <7.3.15, >=7.4.0 <7.4.3
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.28, 7.3.15, 7.4.3
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This High-severity vulnerability is found in the session extension of PHP 7.2 before 7.2.28, 7.3 before 7.3.15 and 7.4 before 7.4.3, and in the End-of-Life PHP 5.6, 7.0 and 7.1 release lines, which never received the upstream fix. The PHP project scores it 7.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

With session.upload_progress.enabled on, PHP watches multipart POST bodies that carry the configured progress field and records the upload's progress in the session. The progress data is created when the first file part starts. When the body ends, the handler either removes the progress entry (session.upload_progress.cleanup on, the default) or marks it as done. In PHP 5.6.40, the end-of-body code reads:

case MULTIPART_EVENT_END: {
    multipart_event_end *data = (multipart_event_end *) event_data;

    if (Z_TYPE(progress->sid) && progress->key.c) {
        if (PS(rfc1867_cleanup)) {
            php_session_rfc1867_cleanup(progress TSRMLS_CC);
        } else {
            add_assoc_bool_ex(progress->data, "done", sizeof("done"), 1);
            Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
            php_session_rfc1867_update(progress, 1 TSRMLS_CC);
        }

The "mark as done" branch assumes the progress data exists. A request that names a session and the progress field but whose part has no file name never starts a file upload, so the progress data is never created, and the handler then dereferences a NULL (on PHP 7, uninitialized) value and crashes. The CVE record describes this as a failed upload with cleanup disabled.

Exploitation needs session.upload_progress.enabled on, which is the default, and session.upload_progress.cleanup set to 0, as the CVE record and the vulnerable code show. Any client that can send a multipart POST request to a PHP script can then crash the worker that handles it, under any server API that accepts multipart POST bodies; repeated requests can keep workers restarting. With cleanup left at its default, the vulnerable branch is not reached. NES for PHP 5.6 also disables session upload progress entirely as part of the mitigation of CVE-2026-109618 and CVE-2026-109619, as its release notes state, so the handler is not exposed there; the fix is still carried.

The fix marks the upload as done only when the progress data was created:

if (!Z_ISUNDEF(progress->data)) {
    SEPARATE_ARRAY(&progress->data);
    add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
    Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
    php_session_rfc1867_update(progress, 1);
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, keep session.upload_progress.cleanup at its default of 1, or set session.upload_progress.enabled to 0 if upload progress is not used.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.28, 7.3.15, 7.4.3, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• ryat (finder)
• Stanislav Malyshev (remediation)