CVE-2019-11043

What is PHP-FPM?

FastCGI Process Manager (FPM) is the process manager most production PHP deployments use to run PHP behind a front-end web server such as Nginx. Nginx cannot execute PHP itself, so it forwards .php requests to FPM over the FastCGI protocol, and FPM's worker pool executes the script and returns the response. Because FPM sits directly in the request path for essentially every dynamic page on a site, a memory-corruption bug reachable pre-authentication turns any Nginx+PHP-FPM stack into a remote code execution target.

Overview

CVE-2019-11043 is a buffer underflow in PHP-FPM's handling of the PATH_INFO FastCGI parameter, triggered by a widely-used but subtly unsafe Nginx configuration pattern that splits the URI into a script path and extra path info using a regular expression such as fastcgi_split_path_info ^(.+\.php)(/.+)$;. By sending a request with a crafted path (ending in a Unicode/newline sequence like %0a), an attacker can make Nginx pass an empty PATH_INFO to FPM while still forwarding the request, causing FPM's env_path_info handling to underflow a buffer and corrupt adjacent heap memory — ultimately allowing arbitrary code execution without any authentication.

Affected Versions

Only installations using the vulnerable fastcgi_split_path_info pattern in Nginx (a configuration recommended in many popular tutorials, including some official framework docs) are exploitable — plain Apache+mod_php or Nginx configs that don't split PATH_INFO are not affected by the network vector.

Technical Details

The root cause (CWE-120, buffer copy without checking size of input) lies in sapi/fpm/fpm/fpm_main.c, where FPM computes the length of PATH_INFO to reconstruct the original script filename. When Nginx's regex produces an empty PATH_INFO capture group for a request whose URI is crafted with a trailing newline/space-like byte, FPM's length calculation underflows, and a subsequent memcpy-style write goes out of bounds into the FPM zend_string allocator's structures. Careful heap grooming (achieved by manipulating the request body / Content-Length and buffer sizes) lets an attacker turn this memory corruption into overwriting internal opcode/string data, and ultimately execute arbitrary PHP code or shell commands via FPM. Exploitation requires no authentication, a single crafted HTTP request pair, and works over the network (AV:N), though the CVSS vector marks attack complexity High because reliable heap-layout control is needed for weaponization.

Discovery

The underlying misconfiguration pattern was first flagged by security researcher Andrew Danau, who noticed the risky PATH_INFO handling. Security researcher Emil Lerner ("neex") of Wallarm then developed the underflow into a full working remote code execution exploit and published a detailed technical writeup and demo shortly before the CVE was assigned in October 2019.

Exploitation Context

Working exploits were published within days of disclosure and were rapidly weaponized; mass internet scanning for vulnerable Nginx+PHP-FPM stacks began almost immediately. CISA's KEV listing (with ransomwareUse: true) reflects that this bug has since been folded into ransomware-affiliated intrusion toolkits and opportunistic scanning campaigns targeting unpatched, internet-facing PHP applications.

Remediation

1. Upgrade PHP to 7.1.33, 7.2.24, 7.3.11, or later — the fix is in PHP-FPM itself, not just Nginx.
2. If upgrading isn't immediately possible, avoid the vulnerable fastcgi_split_path_info regex pattern, or add a check in Nginx to reject request URIs containing suspicious sequences (e.g., regex validation that PATH_INFO is non-empty) before proxying to FPM.
3. Set cgi.fix_pathinfo=0 in php.ini where PATH_INFO handling is not required by the application.
4. Restrict FPM to only accept requests for files that actually exist on disk (try_files $uri =404; in Nginx) rather than always forwarding to the FastCGI backend.
5. Review web server and application logs for anomalous requests containing encoded newlines or malformed PATH_INFO segments predating patching.