Bug #66600 [NEW]: FPM Module is Exposed in URL (/fcgi-php-fpm/)

From: hansv at senseofsecurity dot com dot au Operating system: Debian PHP version: Irrelevant Package: FPM related Bug Type: Bug Bug description:FPM Module is Exposed in URL (/fcgi-php-fpm/) Description: ------------ When a file is requested on a website by a user, it is normally done as follows: http://127.0.0.1/somefile.php During a review of logs, it was discovered that the same file can be called: http://127.0.0.1/fcgi-php-fpm/somefile.php Which confirms that FCGI is in use. Furthermore, some misconfigurations may allow the user or an attacker to access files outside the document root as follows: http://127.0.0.1/fcgi-php-fpm/home/v1234567890/html/somefile.php Where "/home/v1234567890/html/" is an example of a shared hosting URL. (This was confirmed.) Can you please look into this if it's an unknown bug or feature that you can't disable? (It looks like a feature.) If it's a known feature that you can disable, is it possible to disable in the PHP FPM configuration files? And if so, how/where? Version used: 5.4.4-14+deb7u5 (Latest Debian version package) --- From manual page: http://www.php.net/install.fpm --- Test script: --------------- Please see description. Expected result: ---------------- When the "/fcgi-php-fpm/" path is included in the URL, and a PHP file executes as it should it is revealed that PHP FPM is in use even though all other headers and filenames may have been removed. Furthermore, in some shared hosting cases, it is possible to access files below the "document root" for that user and possibly other users, depending on how severe an "access control misconfiguration" is. -- Edit bug report at https://bugs.php.net/bug.php?id=66600&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66600&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66600&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66600&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66600&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66600&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66600&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66600&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66600&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66600&r=support Expected behavior: https://bugs.php.net/fix.php?id=66600&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66600&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66600&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66600&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66600&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66600&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66600&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66600&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66600&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66600&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66600&r=mysqlcfg