CVE-2022-31628

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its phar extension reads PHP archives, which may be compressed as a whole with gzip or bzip2, through the phar:// stream wrapper and the Phar classes.

A Denial of Service (DoS) vulnerability (CVE-2022-31628) has been identified in the archive loader of PHP's phar extension, which allows an attacker who can make an application open a crafted file as a phar archive to make the PHP process loop forever, because the loader keeps decompressing an archive for as long as the result is still compressed. PHP tracks this issue as bug #81726.

Per MITRE CWE-674: The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

This issue affects PHP 7.4 before 7.4.32, PHP 8.0 before 8.0.24 and PHP 8.1 before 8.1.11, as well as all releases of the End-of-Life PHP 5.6 through 7.3 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/phar)
• Affected versions: <7.4.32, >=8.0.0 <8.0.24, >=8.1.0 <8.1.11
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.4.32, 8.0.24, 8.1.11
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)

Vulnerability Info

This Low-severity vulnerability is found in the phar extension of PHP 7.4 before 7.4.32, 8.0 before 8.0.24 and 8.1 before 8.1.11, and in the End-of-Life PHP 5.6 through 7.3 release lines, which never received the upstream fix. The PHP project scores it 2.3 under CVSS 3.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). The CVE record gives the PHP 7.4 boundary as 7.4.31, but PHP's 7.4 changelog lists the fix in 7.4.32, the next 7.4 release after 7.4.30.

When PHP opens a phar archive, phar_open_from_fp() scans the file for the archive's signature. If the file starts with the gzip or bzip2 magic bytes, it decompresses the whole file into a temporary stream and starts the scan over, because the decompressed data may itself be compressed. In PHP 7.4.30, the gzip branch ends:

php_stream_filter_flush(filter, 1);
php_stream_filter_remove(filter, 1);
php_stream_close(fp);
fp = temp;
php_stream_rewind(fp);
compression = PHAR_FILE_COMPRESSED_GZ;

/* now, start over */
test = '\0';
continue;

Nothing limits how many times this happens. A compressed file quine, a gzip file that decompresses to itself, sends the loader around the loop forever, and the request does not finish. As the upstream fix notes, deeply nested compression without a true quine can also cause excessive work.

Exploitation needs an application that opens a file an attacker supplies through the phar:// wrapper or one of the phar functions, under any server API. The process then spins until a time limit or the server stops it, which can tie up workers. The PHP project's score treats the attack as needing local access with high privileges. Applications that never open attacker-supplied files as phar archives are not exposed.

The fix limits decompression to three levels and fails with an "unable to decompress gzipped phar archive" (or "bzipped") error after that. A follow-up commit fixed a regression this caused when a new tar-based phar is created. The gzip branch now ends:

/* now, start over */
test = '\0';
if (!--recursion_count) {
    MAPPHAR_ALLOC_FAIL("unable to decompress gzipped phar archive \"%s\"");
    break;
}
continue;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2 and 7.3 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.4.32, 8.0.24, 8.1.11, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• real_as3617 (finder)
• gPayl0ad (finder)
• Christoph M. Becker (remediation)