PHP-CGI Query String Parameter
CVE-2012-1823 is a high-severity improper neutralization of special elements used in a command vulnerability in PHP, with a CVSS 2.0 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 5.3.12, 5.4.2 as the first without the flaw, so updating PHP to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on March 25, 2022, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update PHP to 5.3.12 or 5.4.2, whichever matches your release line, or a later version.
- Update Mac OS X to 10.7.5 or 10.8.2, whichever matches your release line, or a later version.
- CISA's required action: Apply updates per vendor instructions.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| PHP | PHP | before 5.3.12; 5.4.0 up to, but not including, 5.4.2 | 5.3.12, 5.4.2 |
| Fedora Project | Fedora | 39; 40 | Not stated |
| Debian | Debian Linux | 6.0 | Not stated |
| HP | Hp-ux | b.11.23; b.11.31 | Not stated |
| openSUSE | Opensuse | 11.4; 12.1 | Not stated |
| SUSE | Linux Enterprise Server | 10; 11 | Not stated |
| SUSE | Linux Enterprise Software Development Kit | 10; 11 | Not stated |
| Apple | Mac OS X | 10.6.8 up to, but not including, 10.7.5; 10.8.0 up to, but not including, 10.8.2 | 10.7.5, 10.8.2 |
| Red Hat | Application Stack | 2.0 | Not stated |
| Red Hat | Gluster Storage Server For On-premise | 2.0 | Not stated |
| Red Hat | Storage | 2.0 | Not stated |
| Red Hat | Storage For Public Cloud | 2.0 | Not stated |
| Red Hat | Enterprise Linux Desktop | 6.0 | Not stated |
| Red Hat | Enterprise Linux EUS | 5.6; 6.1; 6.2 | Not stated |
| Red Hat | Enterprise Linux Server | 5.0; 6.0 | Not stated |
| Red Hat | Enterprise Linux Server AUS | 5.3; 5.6 | Not stated |
| Red Hat | Enterprise Linux Workstation | 5.0; 6.0 | Not stated |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Access vector
- NetworkCan be exploited remotely over a network.
- Access complexity
- LowNo special conditions are needed.
- Authentication
- NoneNo login is needed.
- Confidentiality
- PartialSome data can be read.
- Integrity
- PartialSome data can be modified.
- Availability
- PartialAvailability is reduced.
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CISA (ADP) |
| CVSS 2.0 | 7.5 | High | NVD |
Official description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Neutralization of Special Elements used in a Command
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
How developers prevent this class of flaw
- If at all possible, use library calls rather than external processes to recreate the desired functionality.
- If possible, ensure that all external commands called from the program are statically created.
- Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
More Improper Neutralization of Special Elements used in a Command vulnerabilities (CWE-77)
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- php.net/ChangeLog-5.php#5.4.2Exploit, Release Notes
- php.net/archive/2012.php#id2012-05-03-1Release Notes
- bugs.php.net/bug.php?id=61910Exploit
- bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CS…Mailing List, Release Notes
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2…Mailing List, Release Notes
- lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAU…Mailing List, Release Notes
Third-party and government advisories
- lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlMailing List, Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.htmlMailing List, Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.htmlMailing List, Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.htmlMailing List, Third Party Advisory
- rhn.redhat.com/errata/RHSA-2012-0546.htmlThird Party Advisory
- rhn.redhat.com/errata/RHSA-2012-0547.htmlThird Party Advisory
- rhn.redhat.com/errata/RHSA-2012-0568.htmlThird Party Advisory
- rhn.redhat.com/errata/RHSA-2012-0569.htmlThird Party Advisory
- rhn.redhat.com/errata/RHSA-2012-0570.htmlThird Party Advisory
- support.apple.com/kb/HT5501Third Party Advisory
- debian.org/security/2012/dsa-2465Third Party Advisory
- kb.cert.org/vuls/id/673343Third Party Advisory, US Government Resource
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823US Government Resource
Technical write-ups (may include proof of concept)
- kb.cert.org/vuls/id/520827Exploit, Third Party Advisory, US Government Resource
Other references
- marc.info/?l=bugtraq&m=134012830914727&w=2Mailing List
- openwall.com/lists/oss-security/2024/06/07/1Mailing List
Other vulnerabilities in PHP
- 7.5 High severity
- 8.8 High severity
- 8.8 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
Recent Improper Neutralization of Special Elements used in a Command vulnerabilities
- 7.8 High severity
Exim Privilege Escalation Exploited
- 9.8 Critical severity
- 9.8 Critical severity
Spotted an error? Tell us.