CISA flags old PHP flaws in Fuel-Boss ICS
CISA warns that All-Line Equipment Company's Fuel-Boss fuel management systems bundle outdated PHP components vulnerable to remote code execution.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-11043 as exploited in the wild.
CISA has published an ICS advisory covering All-Line Equipment Company's Fuel-Boss product line (V1 Standard, Portal, Master/Slave, and Backflush Systems), which run PHP versions up to and including 7.1.5. These builds are affected by two long-known PHP vulnerabilities: CVE-2018-19518, an argument injection flaw in the University of Washington IMAP Toolkit's imap_open() function that can allow remote command execution or a stack-based buffer overflow when a malicious IMAP server name is supplied; and CVE-2019-11043, a PHP-FPM buffer overflow that can enable remote code execution under certain FastCGI configurations.
Fuel-Boss systems are deployed worldwide and touch critical manufacturing, defense industrial base, emergency services, and transportation sectors, given their role in fuel dispensing and management. Fixes are available for the Standard and Portal variants; no fix currently exists for Master/Slave, and the vendor has stated no fix is planned for Backflush Systems, leaving some deployments permanently exposed unless mitigated through network controls.
CISA rates the attack complexity as high and recommends standard ICS hardening: removing unfixed devices from direct internet exposure, restricting access via firewalls/router-level IP allowlisting, and using VPNs for remote access where required. No in-the-wild exploitation of Fuel-Boss specifically is reported; this is a vendor-notification advisory based on anonymous reporting of outdated component usage rather than an active campaign.
Mentioned in this report
Detection guidance
PHP-FPM or PHP-CGI Process Spawning a Command Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or interpreter process being spawned as a child of php-fpm or php-cgi, indicating likely successful remote code execution through a PHP web-facing vulnerability such as the PHP-FPM FastCGI overflow (CVE-2019-11043) present in unpatched Fuel-Boss ICS deployments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-FPM or PHP-CGI Process Spawning a Command Shell
description: Detects php-fpm or php-cgi worker processes spawning a shell (sh, bash,
dash) or scripting interpreter, a strong indicator of successful remote code execution
following exploitation of a PHP FastCGI vulnerability (e.g. CVE-2019-11043) on internet-exposed
ICS/web components running outdated PHP such as Fuel-Boss.
tags:
- attack.execution
- attack.t1210
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /php
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /perl
condition: selection
falsepositives:
- PHP applications legitimately invoking shell utilities via exec()/shell_exec() for
administrative scripts
- Custom CMS or ICS management panels that call system tools from PHP by design
level: medium
id: 534fc8cd-217d-5739-85f0-49125199d6d1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-02
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs