H3-2022-0050¶

PHP-FPM Configuration File Exposure

Description¶

PHP-FPM is a method to execute PHP in modern environments.

Impact¶

An attacker can pass PHP configuration options that allows injection of a PHP script to a listening PHP-FPM service and in some cases achieve remote code execution.

References¶

• RCE Attacks Targeting Misconfigured Open PHP-FPM
• FPM configuration
• CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory