CVE-2020-7067

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

An Out-of-Bounds Read vulnerability (CVE-2020-7067) has been identified in PHP's urldecode() and rawurldecode() functions, which allows an attacker who can supply a URL-encoded string to a PHP build compiled with EBCDIC support to make PHP read memory located before a conversion table and place those bytes in the decoded result. PHP tracks this issue as bug #79465.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.2.30, PHP 7.3 before 7.3.17 and PHP 7.4 before 7.4.5, including the End-of-Life release lines PHP 5.6, 7.0 and 7.1 through their final releases (5.6.40, 7.0.33 and 7.1.33), in each case only when PHP is compiled with EBCDIC support.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <7.2.30, >=7.3.0 <7.3.17, >=7.4.0 <7.4.5
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.30, 7.3.17, 7.4.5
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This High-severity vulnerability is found in the standard extension of PHP before 7.2.30, 7.3 before 7.3.17 and 7.4 before 7.4.5, including the End-of-Life PHP 5.6, 7.0 and 7.1 release lines, which never received the upstream fix. It only exists when PHP is compiled with EBCDIC support, which the CVE record describes as uncommon. The PHP project scores it 7.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

urldecode() and rawurldecode() turn each %XX escape into the byte it encodes. On EBCDIC platforms, such as IBM mainframes, PHP then maps that byte through the 256-entry os_toebcdic table. In PHP 5.6.40, php_url_decode() reads:

#ifndef CHARSET_EBCDIC
    *dest = (char) php_htoi(data + 1);
#else
    *dest = os_toebcdic[(char) php_htoi(data + 1)];
#endif

The decoded value is cast to char before it is used as the table index. Where char is signed, an escape above %7F becomes a negative index, and the lookup reads up to 128 bytes before the start of os_toebcdic. Those bytes end up in the decoded string, which can disclose the contents of nearby memory. php_raw_url_decode(), behind rawurldecode(), has the same line.

Exploitation needs a PHP build compiled with EBCDIC support and an application that decodes attacker-supplied text with these functions. Builds for ASCII platforms compile the other branch and are not affected. HeroDevs' analysis notes that NES for PHP 5 ships x86_64 builds only, which never had the out-of-bounds read; the fix is carried so the code matches upstream.

The fix casts the decoded value to an unsigned type before it is used as an index, so every escape maps to an entry inside the table.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.30, 7.3.17, 7.4.5, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• bigshaq (finder)
• Stanislav Malyshev (remediation)