CVE-2014-0185

What it actually does

PHP FPM creates its UNIX domain socket with 0666 permissions, allowing any local process to connect and issue FastCGI requests that execute with the privileges of the FPM worker pool.

Why it matters to the business

Attackers who already have a shell on the server can obtain root or web-server privileges, leading to full system compromise and data exposure; the issue is more than a decade old with public exploits available.

How an attack unfolds

An attacker with local shell access locates the FPM UNIX socket, crafts a malicious FastCGI client that connects to it, and sends requests that cause the FPM worker to execute attacker-supplied code at elevated privileges.

How to fix it

Upgrade PHP to 5.4.28 or newer, or 5.5.12 or newer; alternatively set the FPM listen.acl_users or listen.mode directives to restrict socket access to the web server user only.

How to confirm the fix worked

Verify PHP version is at least 5.4.28 or 5.5.12; confirm socket permissions are no longer 0666 with ls -l and that listen.acl_users or equivalent restrictions are configured.

Typical attack path

1. Obtain local shell on the affected host
2. Locate the FPM UNIX socket file (commonly under /var/run)
3. Connect using a crafted FastCGI client or library
4. Issue requests that trigger code execution as the FPM pool user
5. Escalate to full system control

How to detect it

Review system and web-server logs for unexpected local connections to FPM sockets; look for processes spawning under the FPM worker UID shortly after socket access by non-web users.

What your security team should do

• Immediately upgrade all PHP installations to a supported branch containing the fix
• Audit FPM pool configurations and enforce least-privilege socket permissions
• Remove or disable FPM sockets that are no longer required
• Monitor for local privilege-escalation attempts on hosts still running legacy PHP