CVE-2024-11234
High · 7.2CVSS
7.2
EPSS
1.1%
Published
Nov 24, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A flaw in certain PHP versions lets attackers trick the server into making web requests it should not, potentially reaching private systems.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Exposure
- Component
- Library
- Class
- SSRF
- Remediation
- Upgrade
- Effort
- Low
- Patch risk
- Low
What it actually does
Improper URI sanitization in PHP stream wrappers when proxy and request_fulluri are enabled allows crafted URIs to perform HTTP request smuggling, enabling the server to issue arbitrary HTTP requests to internal or external targets via the configured proxy.
Why it matters to the business
Attackers may reach internal resources or services that are normally inaccessible from outside the network, increasing risk of data exposure or unauthorized actions; low EPSS and no KEV listing indicate limited observed exploitation but patching remains important given wide PHP usage.
How an attack unfolds
An attacker supplies a malicious URI containing smuggling sequences to a PHP application using streams with an outbound proxy and request_fulluri enabled; the unsanitized URI causes the proxy to forward attacker-controlled requests that appear to originate from the server, bypassing access controls.
How to fix it
Upgrade PHP to 8.1.31 or later, 8.2.26 or later, or 8.3.14 or later. For php/php-src apply commit 38123aca18c3c1bd1f109ec77af2f175d7afcf35. Review and disable request_fulluri where possible or enforce strict URI allow-lists.
How to confirm the fix worked
Confirm PHP version is at or above the fixed releases; test stream proxy behavior with a known smuggling URI to verify requests are rejected or sanitized; audit configuration files for request_fulluri settings.
Typical attack path
- Identify PHP application using stream contexts with proxy and request_fulluri set
- Craft URI containing HTTP request smuggling payload targeting internal endpoints
- Trigger the vulnerable stream operation from the application
- Proxy forwards the smuggled request, granting access to protected resources
How to detect it
Review web server and application logs for unusual URIs containing smuggling patterns or unexpected proxy destinations; inspect PHP stream context configurations for request_fulluri usage; correlate with proxy logs for requests that appear to originate internally but target restricted resources.
What your security team should do
- Apply the listed PHP version upgrades immediately on all affected systems
- Scan codebases for use of stream contexts with proxy and request_fulluri
- Implement network controls to limit proxy destinations to approved targets
- Monitor for unusual outbound requests originating from web servers
The record
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip-devel | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip-tools | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-bcmath | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-cli | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-common | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-dba | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-dbg | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-devel | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-embedded | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-enchant | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-ffi | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-fpm | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-gd | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-gmp | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-intl | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-ldap | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-mbstring | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-mysqlnd | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-odbc | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-opcache | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-pdo | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-pear | 0 | 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-apcu | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-apcu-devel | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-rrd | 0 | 2.0.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-xdebug3 | 0 | 3.2.2-2.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-zip | 0 | 1.22.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pgsql | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-process | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-snmp | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-soap | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-xml | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:9 | apcu-panel | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | apcu-panel | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-bcmath | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-bcmath | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-cli | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-cli | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-common | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-common | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-dba | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-dba | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-dbg | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-dbg | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-devel | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-devel | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-embedded | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-embedded | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-enchant | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-enchant | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-ffi | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-ffi | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-fpm | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-fpm | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-gd | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-gd | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-gmp | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-gmp | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-intl | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-intl | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-ldap | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-ldap | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-mbstring | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-mbstring | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-mysqlnd | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-mysqlnd | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-odbc | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-odbc | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-opcache | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-opcache | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-pdo | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-pdo | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-pecl-apcu | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-apcu | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-apcu-devel | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-apcu-devel | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-rrd | 0 | 2.0.3-4.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-rrd | 0 | 2.0.3-4.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-xdebug3 | 0 | 3.1.4-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-xdebug3 | 0 | 3.2.2-2.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-zip | 0 | 1.20.1-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-zip | 0 | 1.22.3-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pgsql | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-pgsql | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-process | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-process | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-snmp | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-snmp | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-soap | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-soap | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-xml | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-xml | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| Bitnami | libphp | 0 | 8.1.31 |
| Bitnami | php | 0 | 8.1.31 |
| Bitnami | php | 8.1.0 | 8.1.31 |
| Bitnami | php-min | 0 | 8.1.31 |
| Bitnami | php-min | 8.1.0 | 8.1.31 |
| Chainguard | php-8.1 | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-apache | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bcmath | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bcmath-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bz2 | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bz2-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-calendar | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-calendar-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-cgi | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ctype | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ctype-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-curl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-curl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dbg | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dev | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-doc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dom | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dom-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-exif | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-exif-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fileinfo | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fileinfo-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fpm | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fpm-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ftp | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ftp-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gd | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gd-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gettext | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gettext-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gmp | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gmp-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-iconv | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-iconv-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-intl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-intl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ldap | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ldap-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mbstring | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mbstring-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqli | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqli-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqlnd | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqlnd-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-odbc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-odbc-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-opcache | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-opcache-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-openssl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-openssl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pcntl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pcntl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_dblib | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_dblib-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_mysql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_mysql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_odbc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_odbc-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_pgsql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_pgsql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_sqlite | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_sqlite-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pear | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pgsql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pgsql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-phar | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-phar-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-posix | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-posix-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-simplexml | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-simplexml-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-soap | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-soap-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sockets | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sockets-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sodium | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sodium-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvsem | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvsem-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvshm | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvshm-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xml | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xml-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlreader | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlreader-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlwriter | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlwriter-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xsl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xsl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-zip | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-zip-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.2 | 0 | 8.2.26-r0 |
| Chainguard | php-8.2-apache | 0 | 8.2.26-r0 |
| Chainguard | php-8.2-bcmath | 0 | 8.2.26-r0 |
| Chainguard | php-8.2-bcmath-config | 0 | 8.2.26-r0 |
Related vulnerabilities
- CVE-2024-11233 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an… Also affects apcu-panel
- CVE-2024-8929 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile… Also affects apcu-panel
- CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using… Also affects apcu-panel
- CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12… Also affects apcu-panel
- CVE-2024-8925 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous… Also affects apcu-panel
- CVE-2024-2756 Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j… Also affects apcu-panel
- CVE-2023-0567 In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify()… Also affects apcu-panel
- CVE-2022-31631 A flaw was found in PHP. Also affects apcu-panel