CVE-2024-11233

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its standard extension, which is always built, provides stream filters such as convert.quoted-printable-decode, which decode data as it is read or written through php://filter or stream_filter_append().

An Out-of-Bounds Read vulnerability (CVE-2024-11233) has been identified in the convert.quoted-printable-decode stream filter of PHP's standard extension, which allows an attacker who can supply data that an application decodes with this filter to make PHP read one byte past the end of its input buffer, which can in certain circumstances crash the process or disclose the content of other memory. PHP tracks this issue as GHSA-r977-prxv-hc43.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP before 8.1.31, PHP 8.2 before 8.2.26 and PHP 8.3 before 8.3.14, which includes the End-of-Life release lines PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4 and 8.0 through their final releases.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <8.1.31, >=8.2.0 <8.2.26, >=8.3.0 <8.3.14
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.1.31, 8.2.26, 8.3.14
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the standard extension of PHP before 8.1.31, 8.2 before 8.2.26 and 8.3 before 8.3.14, including the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4 and 8.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) and classifies it as CWE-122, Heap-based Buffer Overflow; the flaw itself is a one-byte read past the input.

Quoted-printable encoding marks a soft line break with an equals sign at the end of a line, followed by a line break. The decoder in php_conv_qprint_decode_convert() works as a state machine over the input buffer, so that data split across several reads is handled correctly. After it has seen an equals sign and a carriage return, state 5 looks at the next character to decide whether it is the line feed that completes the line break. Before the fix, that state reads:

case 5: {
    if (!inst->lbchars && lb_cnt == 1 && *ps == '\n') {
        /* auto-detect soft line breaks, found network line break */
        lb_cnt = lb_ptr = 0;
        scan_stat = 0;
        ps++, icnt--; /* consume \n */
    } else if (!inst->lbchars && lb_cnt > 0) {
        /* auto-detect soft line breaks, found mac line break */
        lb_cnt = lb_ptr = 0;
        scan_stat = 0;

The first test dereferences ps before anything checks icnt, the number of input bytes left; that check only came in a later branch. When a chunk of input ends exactly after an equals sign and a carriage return, no bytes remain, and the filter reads one byte past its input buffer. HeroDevs' analysis confirms the same behavior on PHP 5.6, 7.2 and 7.4. Depending on what follows the buffer in memory, the read can crash the process or let one byte of other memory influence the decoded output.

Exploitation needs an application that decodes attacker-supplied data with the convert.quoted-printable-decode filter, for example through a php://filter URL or stream_filter_append(). The filter is part of the always-built standard extension, so the issue is reachable from any server API. The impact is limited to a single byte per occurrence, which is reflected in the low confidentiality and availability ratings. Applications that never apply this filter to untrusted data are not exposed.

The fix moves the bounds check to the start of state 5, so the filter stops and waits for more input before it reads the next character:

case 5: {
    if (icnt == 0) {
        goto out;
    }

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4 and 8.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid applying the convert.quoted-printable-decode filter to untrusted data.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.1.31, 8.2.26, 8.3.14, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Frostb1te (finder)
• Nora Dossche (remediation)