CVE-2018-19395 in PHP
Summary
by MITRE
ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/11/2023
This vulnerability exists in PHP versions 5.x through 7.1.24 on Windows systems where the COM extension fails to properly handle NULL pointer dereferences during serialization operations. The flaw specifically manifests in the interaction between ext/standard/var.c and ext/com_dotnet/com_handlers.c components, where com and com_safearray_proxy functions return NULL values that are not adequately validated before use. When a serialize call is executed on a COM object such as COM("WScript.Shell"), the system attempts to access these NULL pointers leading to application crashes and denial of service conditions. This vulnerability represents a classic NULL pointer dereference issue that falls under CWE-476, which specifically addresses NULL pointer dereference conditions in software implementations. The attack vector is particularly concerning because it leverages the Windows COM (Component Object Model) infrastructure, making it accessible to attackers who can execute PHP code on vulnerable systems. The operational impact extends beyond simple service disruption as this vulnerability can be exploited to crash PHP applications running on Windows servers, potentially affecting web applications that rely on COM object interactions for system integration or automation tasks. The vulnerability is particularly dangerous in environments where PHP applications interact with Windows-specific components, as demonstrated by the WScript.Shell COM object example, which provides access to system shell functionality that attackers could potentially abuse. From an ATT&CK perspective, this vulnerability maps to T1489 which covers denial of service attacks and T1059 which covers command and scripting interpreter usage, as attackers could leverage the COM object access to execute system commands through the WScript.Shell interface. The exploitation requires minimal privileges and can be performed through standard PHP serialization operations, making it a particularly attractive target for automated attacks. Organizations should consider this vulnerability as part of their broader application security posture, particularly in environments where PHP applications interact with Windows system components. The fix involves ensuring proper NULL pointer validation in the com_properties_get function and implementing robust error handling for COM object property access. Additionally, organizations should consider restricting PHP COM extension usage in production environments where possible, and implement proper input validation and sanitization to prevent exploitation. The vulnerability demonstrates the importance of proper error handling in extension modules, especially when interfacing with system-level components like Windows COM objects, where improper handling can lead to complete application crashes and denial of service conditions.