PHP-CGI query string parameter vulnerability
RISK: High Risk
TYPE: Servers - Internet App Servers
A vulnerability has been identified in PHP, which can be exploited by remote users to disclose certain sensitive information or compromise a vulnerable system.
The vulnerability is caused due to an error when parsing certain QUERY_STRING parameters. This can be exploited to e.g. disclose the PHP source code or execute arbitrary code.
Impact
- Remote Code Execution
- Information Disclosure
System / Technologies affected
- PHP 5.3.x
- PHP 5.4.x
Solutions
Apply update
PHP has released version 5.4.2 and 5.3.12 to address this vulnerability. It is recommended that users should upgrade to the latest PHP version.
Apply mod_rewrite rule
PHP has stated an alternative to configure your web server not to let these types of requests with query strings starting with a "-" and not containing a "=" through. Adding a rule like this should not break any sites. For Apache using mod_rewrite it would look like this:
RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC]
RewriteRule ^(.*) $1? [L]
Vulnerability Identifier
Source
Related Link
Share with