PT-2021-9106 · Facebook · Hhvm

Published 2021-10-26 · Updated 2021-10-29 · CVE-2019-3556

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 4.56.2 HHVM versions 4.57.0 through 4.78.0 HHVM versions 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0

Description HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access.

Recommendations For HHVM versions prior to 4.56.2, update to version 4.56.2 or later. For HHVM versions 4.57.0 through 4.78.0, update to version 4.78.1 or later. For HHVM versions 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0, update to a version that is not affected by this issue. As a temporary workaround, consider disabling the dump-pcre-cache request handler until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-3556

Affected Products

Hhvm

References · 10

• https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4 · Patch
• https://ubuntu.com/security/CVE-2019-3556 · Vendor Advisory
• https://hhvm.com/blog/2020/11/12/security-update.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3556 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3556 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3556 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3556 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2019-3556 · Note
• https://t.me/cibsecurity/31253 · Telegram Post
• https://t.me/cvenotify/22651 · Telegram Post