T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2019-11043/ground-truth.yaml

@@ -0,0 +1,27 @@
+cve: CVE-2019-11043
+alias: PHP-FPM env_path_info underflow
+cwe_primary: CWE-787
+cwe_acceptable: [CWE-787, CWE-191, CWE-119, CWE-124, CWE-125]
+target_file: source.c
+vuln_lines: [21, 28, 29, 33]
+severity: critical
+vuln_class: out_of_bounds_write
+exploit_pattern_regex: '%0a|negative.*offset|underflow|path_info'
+must_mention_any:
+  - negative
+  - bounds check
+  - underflow
+  - path_info
+  - script_name
+  - out-of-bounds write
+  - pointer arithmetic
+points: 30
+notes: |
+  Vulnerability: path_info_offset is computed as pointer difference and may
+  go negative when attacker engineers path_info < script_name (via specific
+  URL encodings). The subsequent `script_name[path_info_offset] = '\\0'`
+  writes outside the buffer with attacker-influenced index.
+  Hunter MUST identify:
+    1. The pointer arithmetic that produces path_info_offset.
+    2. The missing bounds check / sign check.
+    3. The out-of-bounds write at the indexed location.

bench/cve-hunt/samples/CVE-2019-11043/source.c

@@ -0,0 +1,37 @@
+/*
+ * PHP-FPM env_path_info handling — pre-CVE-2019-11043.
+ * Reconstruction of fpm_main.c logic that mishandles the path_info pointer
+ * when a crafted URL like /index.php/%0a... causes path_info to point
+ * BEFORE script_name's start, yielding an out-of-bounds write of a NUL byte.
+ */
+
+#include <stddef.h>
+#include <string.h>
+#include <stdlib.h>
+
+typedef struct {
+    char *script_name;       /* attacker-controlled (request URI) */
+    char *path_info;         /* derived from script_name */
+} fcgi_request_t;
+
+static int fpm_handle_request(fcgi_request_t *req) {
+    char *path_info = req->path_info;
+    int   path_info_offset;
+
+    /* Compute offset of path_info into script_name. Normally non-negative. */
+    path_info_offset = path_info - req->script_name;
+
+    /* BUG: when crafted request makes path_info point BEFORE script_name's
+       buffer (e.g. due to %0a sequences earlier), path_info_offset becomes
+       NEGATIVE. No bounds check below.  */
+    if (path_info != NULL) {
+        /* Original code wrote NUL here:
+           script_name[path_info_offset] = '\0';
+           which becomes an out-of-bounds write with attacker control of the
+           negative index, corrupting memory and enabling RCE via overwriting
+           fcgi env table pointers. */
+        req->script_name[path_info_offset] = '\0';
+    }
+
+    return 0;
+}