Introduction

TheOpen Source Technology Improvement Fund, Inc, thanks to funding provided bySovereign Tech Fund, engaged with Quarkslab to perform a security audit ofPHP-SRC, the interpreter of thePHP language.

The audit aimed to assist PHP's core developers and the community in strengthening the project's security ahead of the upcoming PHP 8.4 release. The codebase was analyzed within a defined scope, which was established and agreed upon by both PHP's core developers and the OSTIF teams. Based on this scope and the allocated time frame for the audit, an attack model was developed and approved by the PHP team.

Scope

The assessment was conducted within a set timeframe, with the primary focus on identifying vulnerabilities and security issues in the code according to the defined attack model provided below.

The following scope of work was defined by PHP Foundation and the OSTIF.

• Key tasks

  • basic tooling evaluation;
  • improve SAST tooling to enhance the existing GitHub CI without extra cost and with low maintenance;
  • build fuzzers compatible withoss-fuzz for potential critical functions that are not currently covered;
  • cryptographic and manual code review.

• High priority tasks

  • php-fpm master node and php-fpm worker glue code;
  • FPM pool separation;
  • MySQL Native Driver;
  • RFC 1867 HTTP header parser and MIME handling;
  • PDO: emulated prepares;
  • JSON parsing with a focus onjson_decode;
  • OpenSSL external functions and its stream layerext/openssl;
  • libsodium integrationext/sodium;
  • functionalities related to passwordsext/standard/password.c;
  • functionalities related to hashingext/hash;
  • functionalities related to CSPRNGext/random/csprng.c.

• Extra-considerations tasks: if applicable during the allocated time frame.

PHP-SRC attack surface, with respect to the provided scope-of-work, as defined by Quarkslab

Note:Quarkslab notes that the threat model and associated security issues scoring defined for this security assessment are different from PHP Foundation ones which can be found in theirvulnerability disclosure policy.

To assess the security of PHP-SRC, Quarkslab's team first needed to familiarize themselves with the structure of the project and understand the key tasks outlined in the audit's scope. To achieve this, Quarkslab experts gathered and reviewed the available documentation and project resources. With a clear understanding of the features to be evaluated, Quarkslab developed an attack model that incorporated all the requested key tasks. This model was then presented to PHP's core developers, and once approved, the assessment began.

The evaluation employed a combination of dynamic and static analysis. The static analysis focused on scrutinizing the source code to identify vulnerabilities related to the implementation and logic of the specified assessment targets. Dynamic analysis was used to complement the static review by speeding up the process through fuzzing and validating or refuting the hypotheses generated during the static analysis.

Findings

During the time frame of the security audit, Quarkslab has discovered several security issues and vulnerabilities, among which:

• 2 security issues considered as high severity;
• 6 security issues considered as medium severity;
• 9 security issues considered as low severity;
• 10 issues considered informative.

Most vulnerabilities have been shared via security advisories on the PHP-SRC GitHub repository.Other bugs and issues are provided only in this report.

Four CVEs were issued, namely:

• CVE-2024-9026 forLOW-2;
• CVE-2024-8925 forLOW-4;
• CVE-2024-8928 forHIGH-1;
• CVE-2024-8929 forHIGH-2.

💡Audit report
Complete details can be foundin the audit report.

Important:
This audit report contains two security issues currently redacted while PHP maintainers are actively working on the fixes.Details will be provided after fixes are applied by PHP maintainers. Fixes are complex and in progress.

Conclusion

Quarkslab identified several vulnerabilities and bugs in PHP-SRC, many of which were found to pose significant risks in the context ofPHP-FPM, where PHP scripts are executed continuously by the same OS process, making resource management crucial.

Quarkslab recognizes the considerable security efforts made by PHP's developers to safeguard the tool. Additionally, Quarkslab provided recommendations and strategies for addressing the vulnerabilities, helping to strengthen the open-source tool and enhance its security moving forward.

Finally, Quarkslab would like to thank the OSTIF team and the PHP Foundation and PHP-SRC maintainers for their support and collaboration throughout this security audit.

Further reading

• OSTIF blog post
• PHP Foundation blog post