CVE-2017-7272
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
- CVSS 3.0
- 7.4 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- EPSS
- 3.51% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- php/php
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/97178Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038158
- https://bugs.php.net/bug.php?id=74216Issue Tracking, Vendor Advisory
- https://bugs.php.net/bug.php?id=75505
- https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595aIssue Tracking, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt
- http://www.securityfocus.com/bid/97178Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038158
- https://bugs.php.net/bug.php?id=74216Issue Tracking, Vendor Advisory
- https://bugs.php.net/bug.php?id=75505
- https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595aIssue Tracking, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.