CVE-2020-7062: PHP File Upload DOS Vulnerability

CVE-2020-7062 Overview

CVE-2020-7062 is a null pointer dereference vulnerability in PHP affecting file upload functionality when upload progress tracking is enabled. When session.upload_progress.cleanup is set to 0 (disabled) and a file upload fails, PHP's upload procedure attempts to clean up data that does not exist, resulting in a null pointer dereference. This condition leads to application crashes and denial of service conditions affecting PHP-based web applications.

Critical Impact

Attackers can remotely trigger denial of service conditions by exploiting failed file uploads on PHP servers with upload progress tracking enabled and cleanup disabled, potentially crashing web applications and disrupting service availability.

Affected Products

• PHP versions 7.2.x below 7.2.28
• PHP versions 7.3.x below 7.3.15
• PHP versions 7.4.x below 7.4.3
• openSUSE Leap 15.1
• Debian Linux 8.0, 9.0, 10.0
• Ubuntu Linux 12.04, 14.04 ESM, 16.04 ESM, 18.04 LTS, 19.10

Discovery Timeline

• 2020-02-27 - CVE-2020-7062 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-7062

Vulnerability Analysis

This vulnerability is classified as CWE-476 (Null Pointer Dereference), a memory corruption issue that occurs during PHP's file upload handling process. The flaw exists in the session upload progress tracking mechanism, which is designed to provide real-time upload progress information to web applications.

Under normal operation, when a file upload completes or fails, PHP performs cleanup operations on the upload progress data stored in the session. However, when the session.upload_progress.cleanup configuration directive is set to 0, PHP is instructed not to automatically clean up progress data after upload completion. The vulnerability manifests when an upload fails under these specific conditions—PHP's error handling path still attempts to dereference and clean up progress tracking data that was never properly initialized or has already been cleared.

The null pointer dereference results in an immediate crash of the PHP process, causing denial of service for the affected application. Since PHP commonly runs as a FastCGI process or module within web servers like Apache or Nginx, repeated exploitation can exhaust worker processes or require service restarts.

Root Cause

The root cause is improper null pointer handling in PHP's file upload progress tracking cleanup routine. When session.upload_progress.cleanup is disabled (set to 0) and an upload operation fails, the cleanup function attempts to access and free memory at an address that points to NULL or invalid memory. The code path lacks proper validation to check whether the upload progress data structure was properly initialized before attempting cleanup operations.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP file upload requests to a vulnerable PHP application that has upload progress tracking enabled (session.upload_progress.enabled = 1) but cleanup disabled (session.upload_progress.cleanup = 0). The attacker initiates a file upload request and then causes the upload to fail—either through connection manipulation, sending malformed multipart data, or exceeding upload limits—triggering the vulnerable cleanup code path.

The vulnerability mechanism involves the following sequence: When PHP receives a file upload with progress tracking enabled, it initializes session data structures to track the upload progress. If the upload fails and cleanup is disabled, PHP's error handling attempts to clean up progress data that doesn't exist in the expected state, leading to the null pointer dereference. For detailed technical information, see the PHP Bug Report #79221.

Detection Methods for CVE-2020-7062

Indicators of Compromise

• PHP process crashes or unexpected terminations coinciding with file upload requests
• Web server error logs showing segmentation faults or null pointer dereference errors from PHP workers
• Increased PHP-FPM or Apache mod_php worker restarts during periods of file upload activity
• Application monitoring alerts indicating PHP process availability issues

Detection Strategies

• Monitor web server and PHP error logs for segmentation fault messages and SIGSEGV signals originating from upload handling code paths
• Implement version detection scanning to identify PHP installations running vulnerable versions (7.2.x < 7.2.28, 7.3.x < 7.3.15, 7.4.x < 7.4.3)
• Review PHP configuration files for session.upload_progress.cleanup = 0 combined with session.upload_progress.enabled = 1
• Deploy application-layer monitoring to detect abnormal patterns in file upload request failures

Monitoring Recommendations

• Configure centralized logging to aggregate PHP crash events and correlate with incoming HTTP requests
• Implement process monitoring to alert on PHP-FPM pool restarts or mod_php segmentation faults
• Set up web application firewall rules to detect and log suspicious file upload patterns
• Enable PHP core dump collection for post-incident analysis when investigating potential exploitation attempts

How to Mitigate CVE-2020-7062

Immediate Actions Required

• Upgrade PHP to patched versions: 7.2.28 or later, 7.3.15 or later, or 7.4.3 or later
• As a temporary workaround, set session.upload_progress.cleanup = 1 in php.ini to enable automatic cleanup
• Review and apply operating system vendor patches from Debian, Ubuntu, openSUSE, or Gentoo as applicable
• Restart PHP-FPM or web server services after applying configuration changes or updates

Patch Information

PHP has released patched versions that address this null pointer dereference vulnerability. Organizations should upgrade to PHP 7.2.28, 7.3.15, or 7.4.3 or later versions depending on their PHP branch. The fix adds proper null checks before attempting to clean up upload progress data structures.

Multiple Linux distributions have released security updates addressing this vulnerability:

• Debian Security Advisory DSA-4717
• Debian Security Advisory DSA-4719
• Ubuntu Security Notice USN-4330-1
• openSUSE Security Announcement
• Gentoo GLSA 202003-57

Workarounds

• Enable upload progress cleanup by setting session.upload_progress.cleanup = 1 in php.ini configuration
• Disable upload progress tracking entirely by setting session.upload_progress.enabled = 0 if the feature is not required
• Implement rate limiting on file upload endpoints to reduce potential denial of service impact
• Deploy web application firewalls with rules to filter malformed multipart upload requests

# Configuration workaround in php.ini
# Enable automatic cleanup of upload progress data (recommended)
session.upload_progress.cleanup = 1

# Or disable upload progress tracking entirely if not needed
session.upload_progress.enabled = 0

# Restart PHP-FPM after changes
sudo systemctl restart php-fpm