CVE-2024-11236

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its PDO extension gives applications one database API across drivers; pdo_dblib connects it to Microsoft SQL Server and Sybase through FreeTDS, and pdo_firebird connects it to Firebird.

A Buffer Overflow vulnerability (CVE-2024-11236) has been identified in the PDO::quote() implementations of PHP's pdo_dblib and pdo_firebird drivers, which allows an attacker who can supply a very long string made largely of single quotes to an application that quotes it to make PHP write past the end of a heap buffer. PHP tracks this issue as GHSA-5hqh-c84r-qjcv.

Per MITRE CWE-787: The product writes data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 8.1.31, PHP 8.2 before 8.2.26 and PHP 8.3 before 8.3.14, which includes every release of the End-of-Life PHP 5.6, 7.0 through 7.4 and 8.0 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/pdo_dblib, ext/pdo_firebird)
• Affected versions: <8.1.31, >=8.2.0 <8.2.26, >=8.3.0 <8.3.14
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.1.31, 8.2.26, 8.3.14
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Critical-severity vulnerability is found in the pdo_dblib and pdo_firebird extensions of all versions of PHP before 8.1.31, PHP 8.2 before 8.2.26 and PHP 8.3 before 8.3.14, including the End-of-Life PHP 5.6, 7.0 through 7.4 and 8.0 release lines, which never received the upstream fix. The PHP project scores it 9.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The description text in the CVE record repeats that of CVE-2024-8932 (ldap_escape()), but its title and the linked advisory describe the dblib and Firebird quoters.

PDO::quote() wraps a string in single quotes and doubles every single quote inside it, so the output can be almost twice as long as the input. The dblib driver first counts the output length, then allocates a buffer of that size and fills it. In PHP 7.4.33, dblib_handle_quoter() reads:

/* Detect quoted length, adding extra char for doubled single quotes */
for (i = 0; i < unquotedlen; i++) {
    if (unquoted[i] == '\'') ++*quotedlen;
    ++*quotedlen;
}

*quotedlen += 2; /* +2 for opening, closing quotes */
if (use_national_character_set) {
    ++*quotedlen; /* N prefix */
}
q = *quoted = emalloc(*quotedlen + 1); /* Add byte for terminal null */

Nothing checks that the computed length fits its type. On a 32-bit build, an input of about 2 GiB of single quotes makes the count wrap around, so emalloc() allocates a small buffer and the copy loop that follows writes far past its end. The Firebird quoter has the same flaw. On PHP 5.6 the quoted length is a 32-bit int on 64-bit systems too, so HeroDevs' analysis puts the threshold there at about 1 GiB of single quotes, and the result is either a heap overflow or a string with a corrupt length.

Exploitation needs an application that passes very long attacker-supplied text to PDO::quote() on a connected dblib or Firebird handle, with memory_limit and request size limits large enough to hold it. On PHP 7.2 and 7.4 only 32-bit builds are affected; HeroDevs' analysis notes that every NES for PHP 7 build target is 64-bit. On PHP 5.6, 64-bit builds are affected as well. Applications that do not load pdo_dblib or pdo_firebird are not affected. The dblib driver has no native prepared statements, so PDO emulates them and quotes bound string parameters with the same quoter; switching to bound parameters therefore does not avoid the flaw on dblib connections.

The fix makes the quoters detect when the quoted length would overflow, and PDO::quote() then returns false instead of writing past the buffer. NES for PHP carries the fix to PHP 5.6, 7.2 and 7.4, adapting it on PHP 5.6 to refuse a quoted string that would exceed the limit of a PHP 5 string.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4 and 8.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, limit the length of attacker-supplied strings passed to PDO::quote() on dblib and Firebird connections, and keep memory_limit and post_max_size well below the sizes needed to reach the overflow.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.1.31, 8.2.26, 8.3.14, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Nora Dossche (finder, remediation)