CVE-2024-11234: PHP SSRF Vulnerability

CVE-2024-11234 Overview

A critical HTTP request smuggling vulnerability has been identified in PHP's stream handling implementation. When using streams with a configured proxy and the request_fulluri option enabled, the URI is not properly sanitized. This improper input validation allows attackers to inject malicious HTTP requests through the proxy, effectively enabling arbitrary HTTP requests to originate from the vulnerable server. This can lead to unauthorized access to internal resources, bypassing network security controls, and potentially compromising backend systems not normally accessible to external users.

Critical Impact

This vulnerability enables attackers to leverage the server as an HTTP request proxy, potentially accessing internal resources, bypassing firewall restrictions, and performing Server-Side Request Forgery (SSRF) attacks against protected backend services.

Affected Products

• PHP versions 8.1.* before 8.1.31
• PHP versions 8.2.* before 8.2.26
• PHP versions 8.3.* before 8.3.14

Discovery Timeline

• 2024-11-24 - CVE-2024-11234 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-11234

Vulnerability Analysis

This vulnerability stems from inadequate input sanitization in PHP's stream handling subsystem when processing URIs through proxy configurations. The flaw manifests when applications utilize PHP streams with a proxy server configured alongside the request_fulluri stream context option. Under these conditions, user-controlled input within the URI is not properly sanitized before being passed to the proxy, creating an injection point for HTTP request smuggling attacks.

The attack allows an adversary to craft malicious URIs that, when processed by the vulnerable PHP application, result in the server sending attacker-controlled HTTP requests through the configured proxy. This effectively transforms the PHP server into an open proxy under the attacker's control. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-74 (Injection), reflecting both the root cause and the exploitation technique.

Root Cause

The root cause lies in insufficient validation and sanitization of URI data when PHP constructs HTTP requests to be sent through a configured proxy with request_fulluri enabled. The request_fulluri option instructs PHP to send the full URI (including the scheme and host) in the request line when communicating with proxies. Without proper sanitization, specially crafted characters in the URI can break out of the intended request structure and inject additional HTTP headers or complete HTTP requests.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by providing a specially crafted URI to any PHP application that:

1. Uses PHP streams with proxy configuration
2. Has the request_fulluri context option enabled
3. Processes attacker-controllable URI data

By injecting CRLF (Carriage Return Line Feed) sequences or other HTTP-specific control characters into the URI, an attacker can smuggle arbitrary HTTP requests through the proxy. This enables access to internal services, port scanning of internal networks, and potential exploitation of services that trust requests from the PHP server's IP address.

The vulnerability mechanism involves the improper handling of special characters within the URI that should be escaped or rejected. When these characters are passed through to the proxy connection, they are interpreted as HTTP protocol elements, allowing the attacker to inject headers, terminate the original request, and begin a new request entirely. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2024-11234

Indicators of Compromise

• Unusual outbound HTTP connections from PHP application servers to internal IP ranges or localhost
• Proxy logs showing malformed or suspicious URI patterns containing encoded CRLF sequences (%0d%0a)
• Unexpected access to internal services that should not receive external traffic
• Web server logs containing URIs with suspicious character sequences or double HTTP requests

Detection Strategies

• Monitor web application firewall (WAF) logs for requests containing CRLF injection patterns in URI parameters
• Implement network-level monitoring for PHP servers making unexpected connections to internal resources
• Review proxy access logs for anomalous request patterns originating from PHP application servers
• Deploy intrusion detection signatures that identify HTTP request smuggling patterns

Monitoring Recommendations

• Enable detailed logging on proxy servers to capture full request URIs and detect injection attempts
• Implement egress filtering and monitoring on PHP application servers to identify unauthorized internal access
• Configure alerting for PHP servers attempting to access sensitive internal endpoints
• Establish baseline network behavior for PHP applications and alert on deviations

How to Mitigate CVE-2024-11234

Immediate Actions Required

• Upgrade PHP to patched versions: 8.1.31, 8.2.26, or 8.3.14 or later
• Review application code for usage of streams with proxy configurations and request_fulluri option
• Implement input validation on any user-controllable data used in stream URIs
• Consider disabling the request_fulluri option if not strictly required

Patch Information

PHP has released security patches addressing this vulnerability in the following versions:

Organizations should prioritize upgrading to these versions immediately. Additional vendor-specific patches are available from Debian LTS and NetApp.

Workarounds

• Avoid using the request_fulluri stream context option when processing untrusted URI data
• Implement strict input validation and sanitization on all URI components before passing to stream functions
• Deploy network segmentation to limit the impact of potential SSRF attacks
• Use web application firewalls (WAF) to filter requests containing CRLF injection patterns

# Verify PHP version and check if vulnerable
php -v | head -1

# Check for usage of request_fulluri in codebase
grep -r "request_fulluri" /var/www/

# Update PHP on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade php8.3