CVE-2021-21702

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its SOAP extension provides SoapClient, which reads a service's WSDL description and calls its operations.

A Denial of Service (DoS) vulnerability (CVE-2021-21702) has been identified in the WSDL parser of PHP's SOAP extension, which allows a malicious or impersonated SOAP server to crash the PHP process of a client that loads its WSDL by serving a document that contains nodes without the name or namespace the parser expects. PHP tracks this issue as bug #80672.

Per MITRE CWE-476: The product dereferences a pointer that it expects to be valid but is NULL.

This issue affects PHP 7.3 before 7.3.27, PHP 7.4 before 7.4.15 and PHP 8.0 before 8.0.2, as well as all releases of the End-of-Life PHP 5.6 through 7.2 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/soap)
• Affected versions: <7.3.27, >=7.4.0 <7.4.15, >=8.0.0 <8.0.2
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.3.27, 7.4.15, 8.0.2
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)

Vulnerability Info

This Medium-severity vulnerability is found in the SOAP extension of PHP 7.3 before 7.3.27, 7.4 before 7.4.15 and 8.0 before 8.0.2, and in the End-of-Life PHP 5.6 through 7.2 release lines, which never received the upstream fix. The PHP project scores it 5.3 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

When a SoapClient is created in WSDL mode, PHP downloads the WSDL document, parses it with libxml2 and walks its elements and embedded XML schema to learn the service's types and operations. The walk compares each node's name with the element it is looking for through helpers such as node_is_equal_ex(). In PHP 7.3.26, that helper reads:

int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
{
    if (name == NULL || strcmp((char*)node->name, name) == 0) {
        if (ns) {
            xmlNsPtr nsPtr = node_find_ns(node);
            if (nsPtr) {
                return (strcmp((char*)nsPtr->href, ns) == 0);
            } else {
                return FALSE;
            }
        }
        return TRUE;
    }
    return FALSE;
}

Not every XML node has a name. The reporter's WSDL contained a CDATA section inside the definitions element, and passing such a node to strcmp() dereferences a NULL pointer and crashes the process with a segmentation fault. The same assumption appears in attr_is_equal_ex(), in the error messages that print an unexpected element's name, and in the schema code that joins a namespace and a type name, so HeroDevs' analysis describes the trigger as an attribute or element that lacks the name, namespace or children the parser expects.

Exploitation needs an application that creates a SoapClient from a WSDL URL that an attacker controls or can intercept, for example a plain HTTP URL on a network the attacker can reach, under any server API. The attacker can then crash the PHP process or worker each time the WSDL is loaded; the record's impact is limited to availability. Applications that do not use the SOAP extension, or that load WSDL only from trusted, authenticated sources or a local file, are not exposed.

The fix checks for a missing name before comparing, in both helpers, prints an empty string for nameless elements in error messages, and guards the namespace copy:

int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
{
    if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1 and 7.2 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, load WSDL documents only from trusted sources over HTTPS, or from a local copy, so that an attacker cannot supply or alter the document.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.3.27, 7.4.15, 8.0.2, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• jgalindo (finder)
• Stanislav Malyshev (remediation)