PHP-FPM fpm_main.c Underflow Remote Code Execution via fastcgi_split_path_info

CVE-2019-11043 is a buffer underflow in PHP-FPM's fpm_main.c that lets an unauthenticated remote attacker achieve arbitrary code execution on any nginx + PHP-FPM stack where the fastcgi_split_path_info directive uses a regex anchored with ^…$ and no try_files guard is present. By sending a URL containing an encoded newline (%0a), the attacker breaks the regex, forces PATH_INFO to empty, triggers an underflow that corrupts FCGI protocol memory, and ultimately overwrites PHP configuration values (php_value) to point auto_prepend_file at attacker-controlled content. Affected versions are PHP 7.1.x < 7.1.33, 7.2.x < 7.2.24, and 7.3.x < 7.3.11 — all of which have been end-of-life for years.

The vendor CVSS of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is fair for environments that actually run the vulnerable configuration. The specific nginx directive requirement prevents a truly universal 'spray and pop' scenario — you need nginx, PHP-FPM, and the fastcgi_split_path_info pattern without try_files. That said, this config is extremely common in real-world nginx+PHP deployments; dozens of popular tutorials and framework docs recommended it for years. Combined with the CISA KEV listing, public Metasploit module, EPSS of 0.9947, and the fact that the patch has been available since October 2019, any remaining vulnerable instance represents a negligent exposure. The vendor severity is accurate.

Why this verdict

• Unauthenticated RCE from the network — no credentials, no user interaction, no social engineering. An attacker needs only HTTP access to a vulnerable endpoint. This is the most dangerous attack class.
• KEV-listed with EPSS 0.9947 — CISA confirmed active exploitation. The EPSS score is in the 99th+ percentile. This is not theoretical; it is weaponized and deployed at scale.
• Metasploit module and multiple public exploits — the phuip-fpizdam tool automates the entire chain. Metasploit's exploit/multi/http/php_fpm_rce module lowers the skill bar to script-kiddie level.
• Role multiplier: PHP-FPM+nginx stacks commonly serve as internet-facing web application tiers. In many organizations, these are the front door — hosting customer portals, APIs, e-commerce, and CMS platforms. Compromise of a web tier yields access to backend databases, application secrets, and internal network segments. While not a domain controller or hypervisor, the blast radius is tenant-to-segment scale (web server → database credentials → data exfiltration → lateral movement). In containerized or shared-hosting environments, the blast radius can extend to multi-tenant compromise. This keeps the floor at CRITICAL.
• Configuration requirement is common, not rare — the fastcgi_split_path_info pattern with ^…$ regex and no try_files is recommended in official PHP documentation, Laravel deployment guides, WordPress nginx configs, and countless Stack Overflow answers. The 'narrow config' argument does not hold.

Why not higher?

This is already CRITICAL at 9.5. The 0.3-point reduction from 9.8 reflects the genuine configuration prerequisite (fastcgi_split_path_info + no try_files) which does exclude some nginx+PHP-FPM deployments — particularly those using more modern config templates that include file-existence checks. A perfect 10.0 would imply zero prerequisites beyond network reachability.

Why not lower?

Downgrading below CRITICAL is not defensible for a KEV-listed, Metasploit-equipped, unauthenticated RCE. The configuration requirement is widespread enough that it cannot be treated as a rare edge case. The EPSS score of 0.9947 empirically confirms that real-world exploitation probability is near-certain for exposed instances. Any remaining unpatched instance is a live target.

1. Add try_files $uri =404; before every fastcgi_pass directive — This is the most effective mitigation and takes minutes to deploy. It causes nginx to return 404 for non-existent paths before the request ever reaches PHP-FPM, completely neutralizing the underflow. Deploy within 3 days per noisgate mitigation SLA for CRITICAL findings.
2. Block encoded newlines in URI paths at WAF/reverse proxy — Configure your WAF (ModSecurity, Cloudflare, AWS WAF) to reject requests containing %0a or %0d in the URL path. This blocks the exploit's triggering mechanism. Deploy within 3 days.
3. Upgrade PHP to 8.x (or at minimum 7.4.33) — All affected branches (7.1, 7.2, 7.3) are end-of-life and receive no security updates. Upgrading to PHP 8.x eliminates this CVE and hundreds of others. Plan and execute within the 90-day noisgate remediation SLA.
4. Restrict PHP-FPM process privileges and network access — Run PHP-FPM workers with minimal filesystem permissions and block outbound network access from web server hosts where possible. This limits post-exploitation blast radius even if the vuln is triggered.

Run this script on each target host running nginx + PHP-FPM. It checks the installed PHP version and inspects nginx configs for the vulnerable fastcgi_split_path_info pattern. Requires root or sudo to read nginx config files. Example: sudo bash check_cve_2019_11043.sh

#!/usr/bin/env bash
# check_cve_2019_11043.sh — Detect CVE-2019-11043 (PHP-FPM underflow RCE)
# Run on target host as root. Outputs VULNERABLE / PATCHED / UNKNOWN.
set -euo pipefail

RESULT="UNKNOWN"
VULN_PHP=0
VULN_NGINX=0

# --- Check PHP version ---
if command -v php &>/dev/null; then
  PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION.".".PHP_RELEASE_VERSION;' 2>/dev/null || echo "0.0.0")
  IFS='.' read -r MAJ MIN REL <<< "$PHP_VER"
  echo "[*] PHP version detected: $PHP_VER"
  if [[ "$MAJ" -eq 7 ]]; then
    if [[ "$MIN" -eq 1 && "$REL" -lt 33 ]]; then
      VULN_PHP=1
      echo "[!] PHP 7.1.x < 7.1.33 — VULNERABLE version"
    elif [[ "$MIN" -eq 2 && "$REL" -lt 24 ]]; then
      VULN_PHP=1
      echo "[!] PHP 7.2.x < 7.2.24 — VULNERABLE version"
    elif [[ "$MIN" -eq 3 && "$REL" -lt 11 ]]; then
      VULN_PHP=1
      echo "[!] PHP 7.3.x < 7.3.11 — VULNERABLE version"
    else
      echo "[+] PHP version is patched or not in vulnerable range"
    fi
  else
    echo "[+] PHP $MAJ.x is not affected (only PHP 7.1-7.3 vulnerable)"
  fi
else
  echo "[?] PHP not found on this host"
fi

# --- Check nginx config for vulnerable pattern ---
NGINX_CONF_DIRS=("/etc/nginx" "/usr/local/nginx/conf" "/opt/nginx/conf")
for CONFDIR in "${NGINX_CONF_DIRS[@]}"; do
  if [[ -d "$CONFDIR" ]]; then
    echo "[*] Scanning nginx configs in $CONFDIR ..."
    # Look for fastcgi_split_path_info without nearby try_files
    MATCHES=$(grep -rl 'fastcgi_split_path_info' "$CONFDIR" 2>/dev/null || true)
    if [[ -n "$MATCHES" ]]; then
      for F in $MATCHES; do
        echo "[!] fastcgi_split_path_info found in: $F"
        if ! grep -q 'try_files' "$F" 2>/dev/null; then
          VULN_NGINX=1
          echo "[!] No try_files guard found in $F — VULNERABLE config"
        else
          echo "[+] try_files guard present in $F — mitigated"
        fi
      done
    else
      echo "[+] No fastcgi_split_path_info directives found"
    fi
  fi
done

# --- Verdict ---
if [[ "$VULN_PHP" -eq 1 && "$VULN_NGINX" -eq 1 ]]; then
  RESULT="VULNERABLE"
  echo ""
  echo "==> VULNERABLE: CVE-2019-11043 — PHP version AND nginx config are exploitable"
elif [[ "$VULN_PHP" -eq 1 && "$VULN_NGINX" -eq 0 ]]; then
  RESULT="VULNERABLE"
  echo ""
  echo "==> VULNERABLE: PHP version is affected. Nginx config may not be exploitable but upgrade PHP immediately."
elif [[ "$VULN_PHP" -eq 0 ]]; then
  RESULT="PATCHED"
  echo ""
  echo "==> PATCHED: PHP version is not in the vulnerable range"
else
  echo ""
  echo "==> UNKNOWN: Could not determine full exposure"
fi

exit 0

Sources

1. Tenable Plugin 130276
2. Tenable Blog — CVE-2019-11043 Analysis
3. neex/phuip-fpizdam — Original Exploit
4. Exploit-DB — Metasploit Module
5. NGINX Official Mitigation Guide
6. Qualys Blog — CVE-2019-11043 Deep Dive
7. Tenable CVE Entry — CVE-2019-11043
8. Knownsec 404 Team — Vulnerability Analysis