CISA flags old PHP flaws in Fuel-Boss ICS
CISA warns that All-Line Equipment Company's Fuel-Boss fuel management systems bundle outdated PHP components vulnerable to remote code execution.
CISA has published an ICS advisory covering All-Line Equipment Company's Fuel-Boss product line (V1 Standard, Portal, Master/Slave, and Backflush Systems), which run PHP versions up to and including 7.1.5. These builds are affected by two long-known PHP vulnerabilities: CVE-2018-19518, an argument injection flaw in the University of Washington IMAP Toolkit's imap_open() function that can allow remote command execution or a stack-based buffer overflow when a malicious IMAP server name is supplied; and CVE-2019-11043, a PHP-FPM buffer overflow that can enable remote code execution under certain FastCGI configurations.
Fuel-Boss systems are deployed worldwide and touch critical manufacturing, defense industrial base, emergency services, and transportation sectors, given their role in fuel dispensing and management. Fixes are available for the Standard and Portal variants; no fix currently exists for Master/Slave, and the vendor has stated no fix is planned for Backflush Systems, leaving some deployments permanently exposed unless mitigated through network controls.
CISA rates the attack complexity as high and recommends standard ICS hardening: removing unfixed devices from direct internet exposure, restricting access via firewalls/router-level IP allowlisting, and using VPNs for remote access where required. No in-the-wild exploitation of Fuel-Boss specifically is reported; this is a vendor-notification advisory based on anonymous reporting of outdated component usage rather than an active campaign.
Mentioned in this report
Detection guidance
PHP-FPM FastCGI Request with Anomalous Padding (Potential CVE-2019-11043 Exploitation)
Detects the well-known exploitation pattern for the PHP-FPM PATH_INFO buffer overflow (CVE-2019-11043), where an HTTP request to a .php resource contains an abnormally long run of URL-encoded space characters used to overflow the fixed-size buffer before FastCGI parameter injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-FPM FastCGI Request with Anomalous Padding (Potential CVE-2019-11043 Exploitation)
description: Detects HTTP requests to PHP endpoints containing a long sequence of
URL-encoded spaces (%20) preceding or within the PATH_INFO, matching the public
exploitation technique for the PHP-FPM buffer overflow (CVE-2019-11043) affecting
outdated PHP builds such as those used by Fuel-Boss ICS. Generalises on the distinctive
padding pattern rather than a specific payload or host.
tags:
- attack.initial-access
- attack.t1210
logsource:
category: proxy
product: null
detection:
selection:
cs-uri-query|contains: .php
padding_pattern:
cs-uri-query|re: (%20){20,}
condition: selection and padding_pattern
falsepositives:
- Legitimate applications generating unusually long padded query strings (rare)
- Automated vulnerability scanners testing for this exact CVE
level: high
id: 0bca7ba2-6777-59ad-b88b-5182d5add147
status: experimental
author: Vorant
PHP-FPM or PHP-CGI Process Spawning a Command Shell
Detects a shell or interpreter process being spawned as a child of php-fpm or php-cgi, indicating likely successful remote code execution through a PHP web-facing vulnerability such as the PHP-FPM FastCGI overflow (CVE-2019-11043) present in unpatched Fuel-Boss ICS deployments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-FPM or PHP-CGI Process Spawning a Command Shell
description: Detects php-fpm or php-cgi worker processes spawning a shell (sh, bash,
dash) or scripting interpreter, a strong indicator of successful remote code execution
following exploitation of a PHP FastCGI vulnerability (e.g. CVE-2019-11043) on internet-exposed
ICS/web components running outdated PHP such as Fuel-Boss.
tags:
- attack.execution
- attack.t1210
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /php
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /perl
condition: selection
falsepositives:
- PHP applications legitimately invoking shell utilities via exec()/shell_exec() for
administrative scripts
- Custom CMS or ICS management panels that call system tools from PHP by design
level: medium
id: 534fc8cd-217d-5739-85f0-49125199d6d1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free