ExploitCVE-2024-9026
Improper Output Neutralization for Logs (CWE-117)
Summary
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
Impact
This vulnerability allows an attacker to manipulate log message content, potentially polluting the final log or removing up to 4 characters from log messages. If PHP-FPM is configured to use syslog output, additional log data removal may be possible. This could lead to the concealment of malicious activities or the creation of misleading audit trails, compromising the integrity and reliability of system logs.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in PHP versions 8.1.30, 8.2.24, and 8.3.12.
Mitigation
1. Update PHP to the latest patched versions: 8.1.30, 8.2.24, or 8.3.12, depending on your current major version. 2. If immediate updating is not possible, consider disabling the catch_workers_output feature in PHP-FPM configuration if it's not critically needed. 3. If using syslog output with PHP-FPM, monitor logs closely for any signs of manipulation or data removal until the patch can be applied. 4. Implement additional logging and monitoring solutions that are separate from PHP-FPM to ensure comprehensive and tamper-resistant logging.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Timeline
Feedly found the first article mentioning CVE-2024-9026. See article
Detection for the vulnerability has been added to Qualys (514132)
Detection for the vulnerability has been added to Qualys (514133)
Detection for the vulnerability has been added to Qualys (38961)
CVE-2024-9026 is a critical vulnerability that allows an attacker to alter logs from child processes due to an unspecified error, potentially compromising the integrity of logging mechanisms. The details regarding exploitation in the wild, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors are not provided in the available information. Further investigation is necessary to assess the full implications and risks associated with this vulnerability. See article
Detection for the vulnerability has been added to Qualys (6021340)
Detection for the vulnerability has been added to Nessus (207997)
Detection for the vulnerability has been added to Qualys (286178)
Detection for the vulnerability has been added to Nessus (208018)