CVE-2023-0662

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

A Denial of Service (DoS) vulnerability (CVE-2023-0662) has been identified in PHP's parser for multipart/form-data request bodies, which allows a remote, unauthenticated attacker to send a form upload with a very large number of parts that consumes CPU and fills the server logs, exhausting CPU or disk space. PHP tracks this issue as GHSA-54hq-v5wp-fqgv.

Per MITRE CWE-400: The product does not properly control the allocation and maintenance of a limited resource.

This issue affects all versions of PHP before 8.0.28, PHP 8.1 before 8.1.16 and PHP 8.2 before 8.2.3.

Details

Module Info

• Product: PHP
• Affected packages: php-src (main/rfc1867.c)
• Affected versions: <8.0.28, >=8.1.0 <8.1.16, >=8.2.0 <8.2.3
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.0.28, 8.1.16, 8.2.3
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This High-severity vulnerability is found in the request body parser of all PHP versions before 8.0.28, PHP 8.1 before 8.1.16 and 8.2 before 8.2.3, including the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3 and 7.4 release lines, which never received the upstream fix. The PHP project scores it 7.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

When a request arrives with a multipart/form-data body, the format browsers use for file uploads, PHP parses the whole body into $_POST and $_FILES before the script starts. The max_input_vars and max_file_uploads settings limit how many variables and files PHP keeps, but they did not limit how many parts the parser processes: every part was parsed, however many there were. In addition, every file part beyond max_file_uploads logged its own warning. In PHP 7.4.33 the check reads:

/* If file_uploads=off, skip the file part */
if (!PG(file_uploads)) {
    skip_upload = 1;
} else if (upload_cnt <= 0) {
    skip_upload = 1;
    sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
}

A single request with a very large number of small parts therefore makes PHP spend CPU time on each part and, for file parts over the limit, write one log entry per part. Repeated requests can exhaust CPU on the server or fill the disk with log entries, as the CVE record describes.

The attack needs no authentication and works with the default configuration against any script on a server that accepts POST bodies, because the body is parsed before the script runs. This covers PHP-FPM, CGI, the Apache module and the CLI built-in server. Ordinary command-line use of PHP does not parse HTTP request bodies and is not affected.

The fix adds a max_multipart_body_parts setting that stops parsing after a given number of parts. Its default of -1 uses the sum of max_input_vars and max_file_uploads. The warning about exceeding max_file_uploads is now raised only once per request. The new limit check reads:

if (--body_parts_cnt < 0) {
    php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
    goto fileupload_done;
}

NES for PHP 5.6, 7.2 and 7.4 add the same max_multipart_body_parts setting with the same default, and report the file upload limit once per request.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3 and 7.4 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.0.28, 8.1.16, 8.2.3, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Jakob Ackermann (finder)
• Jakub Zelenka (remediation)