Bug #80385 [Com]: Response data preceded by post data

From: Date: Mon, 22 Nov 2021 21:16:33 +0000
Subject: Bug #80385 [Com]: Response data preceded by post data
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-237924@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=80385&edit=1

 ID:                 80385
 Comment by:         dklugmann2 at yahoo dot com
 Reported by:        306503207 at qq dot com
 Summary:            Response data preceded by post data
 Status:             Re-Opened
 Type:               Bug
 Package:            FPM related
 Operating System:   CentOS 7.4
 PHP Version:        7.2.34
 Assigned To:        bukka
 Block user comment: N
 Private report:     N

 New Comment:

We also have this problem on Centos 7.

I have tried setting the auto_prepend_file to blank in all the possible config files but it
doesn't help. The issue comes back in a number of hours

Just to stress this is a major bug and makes running our website through docker very difficult if
not impossible as all kinds of parameters are displayed to the user. A pity as Docker is in many
ways an excellent product.

I hope someone in the team can take a look at the issue as it has been a year now since the first
comments above.

Our only solution for now is to bounce the container every few hours which is not ideal.

Thanks


Previous Comments:
------------------------------------------------------------------------
[2021-11-21 16:03:46] blissweb at hotmail dot com

We have this issue.  Our FPM port is set to 9001, so its not related to 9000.   Centos 7.4.25
php-fpm  7.9 centos.  As others have said, the auto_prepend_file starts getting set on its own.

------------------------------------------------------------------------
[2021-04-29 13:34:56] nikic@php.net

I've been trying to reproduce this issue based on the instructions from en3py at hotmail dot
com, but wasn't able to. I'm not seeing any changes in phpinfo output after querying the
FPM status page.

------------------------------------------------------------------------
[2021-04-29 09:53:54] ahirsch29 at gmail dot com

Same problem with php 8.0.3 - raised the issue here: https://bugs.php.net/bug.php?id=80385

------------------------------------------------------------------------
[2021-04-29 08:39:43] requinix@php.net

Related To: Bug #81000

------------------------------------------------------------------------
[2021-03-29 16:41:32] raqooncoon at gmail dot com

I think this may be about 9000 port of php-fpm service. It must not be available from outside of
server, otherwise php-fpm will be vulnerable to sending TCP packets over bogus FastCGI protocol that
leads to execution of arbitrary code and changing running php config.
1) Try set
listen = 127.0.0.1:9000
inside www.conf of php-fpm.
2) Make sure that 9000 port is not opened, check ufw settings.
3) If you use docker, DO NOT EXPOSE 9000 port from php-fpm container. Use reverse-proxy nginx and
docker network for php-fpm to nginx connection.

Read more about this php-fpm vulnerability https://www.x1a0t.com/2020/02/04/Attack-php-fpm/

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=80385


--
Edit this bug report at https://bugs.php.net/bug.php?id=80385&edit=1

Thread (53 messages)

« previous php.bugs (#237924) next »