phpfastcache - phpinfo Resource Exposure

mediumseverity

4.3CVSS score

5.1%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

phpinfo() is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache.

Impact

An attacker can gain access to sensitive information, such as server configuration details, PHP version, and installed extensions.

Fix

Remove or restrict access to the phpinfo.php file in the phpfastcache library.

How to confirm it

Send: GET {{BaseURL}}/vendor/phpfastcache/phpfastcache/docs/examples/phpinfo.php ; GET {{BaseURL}}/vendor/phpfastcache/phpfastcache/examples/phpinfo.php
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2021-37704 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-37704

info:
  name: phpfastcache - phpinfo Resource Exposure
  author: whoever
  severity: medium
  description: phpinfo() is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache.
  impact: |
    An attacker can gain access to sensitive information, such as server configuration details, PHP version, and installed extensions.
  remediation: |
    Remove or restrict access to the phpinfo.php file in the phpfastcache library.
  reference:
    - https://github.com/PHPSocialNetwork/phpfastcache/pull/813
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37704
    - https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-cvh5-p6r6-g2qc
    - https://packagist.org/packages/phpfastcache/phpfastcache
    - https://github.com/PHPSocialNetwork/phpfastcache/blob/master/CHANGELOG.md#807
    - https://github.com/PHPSocialNetwork/phpfastcache/commit/41a77d0d8f126dbd6fbedcd9e6a82e86cdaafa51
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2021-37704
    cwe-id: CWE-668,CWE-200
    epss-score: 0.05128
    epss-percentile: 0.92461
    cpe: cpe:2.3:a:phpfastcache:phpfastcache:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: phpfastcache
    product: phpfastcache
  tags: cve2021,cve,exposure,phpfastcache,phpinfo,phpsocialnetwork,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/vendor/phpfastcache/phpfastcache/docs/examples/phpinfo.php"
      - "{{BaseURL}}/vendor/phpfastcache/phpfastcache/examples/phpinfo.php"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from