CVE-2020-7066: PHP get_headers() SSRF Vulnerability

CVE-2020-7066 Overview

CVE-2020-7066 is an input validation vulnerability in PHP's get_headers() function that allows URL truncation through null byte injection. When the function processes user-supplied URLs containing a null character (\0), the URL is silently truncated at that position. This behavior can lead to incorrect assumptions about the target server, potentially causing sensitive information to be sent to an unintended destination.

Critical Impact

Attackers can manipulate URL processing to redirect HTTP requests to attacker-controlled servers, potentially exposing sensitive data or headers intended for legitimate targets.

Affected Products

• PHP versions 7.2.x below 7.2.29
• PHP versions 7.3.x below 7.3.16
• PHP versions 7.4.x below 7.4.4
• Tenable Tenable.sc (including version 5.19.0)
• openSUSE Leap 15.1
• Debian Linux 8.0, 9.0, and 10.0

Discovery Timeline

• 2020-04-01 - CVE-2020-7066 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-7066

Vulnerability Analysis

This vulnerability stems from improper handling of null bytes within URL strings passed to PHP's get_headers() function. The function is commonly used to retrieve HTTP headers from a remote server, making it a frequent target for URL-based attacks. When a malicious URL containing a null byte is supplied, the URL processing logic truncates the string at the null character position without providing any warning or error to the calling application.

The exploitation potential lies in the semantic difference between how PHP processes the URL internally versus how the application logic interprets the complete URL string. An application might validate that a URL points to a trusted domain, but the actual HTTP request is sent to a different, potentially malicious server due to truncation.

Root Cause

The root cause is improper input validation for null bytes (CWE-170: Improper Null Termination). PHP's get_headers() function uses C-style string handling internally, where null bytes serve as string terminators. When processing user-supplied URLs, the function fails to properly sanitize or reject URLs containing embedded null characters, leading to silent truncation instead of proper error handling or rejection of the malicious input.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can craft a malicious URL that appears to point to a legitimate domain when validated by the application but actually resolves to an attacker-controlled server after null byte truncation. For example, a URL like http://evil.com\0.legitimate.com/path would be truncated to http://evil.com when processed by get_headers(), while application-level validation might see the full string and incorrectly assume the request targets legitimate.com.

This attack can result in information disclosure when applications send authentication headers, cookies, or other sensitive data to the wrong server based on incorrect assumptions about the request target.

Detection Methods for CVE-2020-7066

Indicators of Compromise

• HTTP requests from PHP applications being sent to unexpected or unknown external servers
• Log entries showing get_headers() calls with URLs containing encoded null bytes (%00)
• Unusual outbound network connections from web servers to untrusted destinations
• Application errors or unexpected behavior related to HTTP header retrieval operations

Detection Strategies

• Implement input validation monitoring to detect null byte injection attempts in URL parameters
• Deploy web application firewalls (WAF) with rules to block URLs containing null bytes (%00 or \\x00)
• Monitor PHP application logs for get_headers() function calls with suspicious URL patterns
• Use static application security testing (SAST) tools to identify vulnerable code patterns using get_headers() with user input

Monitoring Recommendations

• Enable detailed logging for all outbound HTTP requests from PHP applications
• Set up alerts for connection attempts to IP addresses or domains not on approved allowlists
• Monitor for URL parameter tampering attempts in web server access logs
• Implement network-level monitoring to detect data exfiltration attempts through redirected requests

How to Mitigate CVE-2020-7066

Immediate Actions Required

• Upgrade PHP to version 7.2.29, 7.3.16, 7.4.4, or later immediately
• Audit all code using get_headers() with user-supplied input
• Implement server-side URL validation that explicitly rejects URLs containing null bytes
• Review and update Tenable.sc to the latest patched version

Patch Information

PHP has released security updates that address this vulnerability. The fix involves proper handling of null bytes in URL processing to prevent silent truncation. Users should update to the following minimum versions:

• PHP 7.2.29 or later for the 7.2.x branch
• PHP 7.3.16 or later for the 7.3.x branch
• PHP 7.4.4 or later for the 7.4.x branch

For detailed information, refer to the PHP Bug Report #79329. Additional security advisories are available from Debian DSA-4717, Debian DSA-4719, and Tenable Security Advisory TNS-2021-14.

Workarounds

• Sanitize all user-supplied URLs by stripping null bytes before passing to get_headers()
• Implement URL allowlisting to restrict which domains can be accessed via get_headers()
• Use filter_var() with FILTER_VALIDATE_URL combined with explicit null byte rejection
• Consider using cURL with proper URL validation as an alternative to get_headers()

# Example PHP configuration to enhance security
# Add to php.ini or .htaccess

# Enable open_basedir restrictions
php_admin_value open_basedir "/var/www/html:/tmp"

# Disable allow_url_fopen if not required (reduces attack surface)
php_admin_flag allow_url_fopen Off

# Enable strict error reporting during development
php_admin_value error_reporting E_ALL