CVE-2022-31626

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its mysqlnd library is PHP's native MySQL client, used by the mysqli and pdo_mysql extensions (and, on PHP 5.6, the legacy mysql extension) to talk to MySQL and MariaDB servers.

A Buffer Overflow vulnerability (CVE-2022-31626) has been identified in the authentication code of PHP's mysqlnd client library, which allows an attacker who can make a PHP application connect to a server they control with a password they choose to overflow a heap buffer in the PHP process, which the CVE record says can lead to remote code execution. PHP tracks this issue as bug #81719.

Per MITRE CWE-120: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

This issue affects all versions of PHP before 7.4.30, PHP 8.0 before 8.0.20 and PHP 8.1 before 8.1.7.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/mysqlnd)
• Affected versions: <7.4.30, >=8.0.0 <8.0.20, >=8.1.0 <8.1.7
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.4.30, 8.0.20, 8.1.7
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)

Vulnerability Info

This High-severity vulnerability is found in the mysqlnd library of all PHP versions before 7.4.30, PHP 8.0 before 8.0.20 and 8.1 before 8.1.7, including the End-of-Life PHP 5.6, 7.0, 7.1, 7.2 and 7.3 release lines, which never received the upstream fix. The PHP project scores it 7.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

During the MySQL handshake the server can ask the client to switch to another authentication method. With a method such as mysql_clear_password, the client then sends the password itself. mysqlnd builds that packet in php_mysqlnd_change_auth_response_write(): it picks the connection's command buffer if it is large enough, or allocates a new one, and copies the authentication data in after the 4-byte packet header. In PHP 7.4.29 the function reads:

zend_uchar * const buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len);
zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */

DBG_ENTER("php_mysqlnd_change_auth_response_write");

if (packet->auth_data_len) {
    memcpy(p, packet->auth_data, packet->auth_data_len);
    p+= packet->auth_data_len;
}

The buffer is sized for the authentication data alone, but the data is written starting 4 bytes into it, so the copy runs up to 4 bytes past the end of the heap buffer. The overflow is reached when a server requests the mysql_clear_password authentication method: a 4096-byte password makes an unfixed client write 4 bytes past its 4096-byte command buffer. The reporter, Charles Fol, described the flaw as exploitable for remote code execution by making PHP connect to a rogue MySQL server.

Exploitation needs an application that lets an attacker choose both the server it connects to and the password it sends, which is how database administration tools such as Adminer and phpMyAdmin work. Applications that connect only to their own configured database servers with fixed credentials are not exposed. All SAPIs are affected when mysqli or pdo_mysql is built against mysqlnd, and on PHP 5.6 also the mysql extension when built with mysqlnd.

The fix, by Stanislav Malyshev, includes the header in the size used to choose or allocate the buffer:

size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE;
zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size);

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2 and 7.3 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not let users choose the database host that a PHP application connects to, or restrict outbound connections from such tools to known database servers.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.4.30, 8.0.20, 8.1.7, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Charles Fol (finder)
• Stanislav Malyshev (remediation)