CVE-2020-1888
📋 TL;DR
CVE-2020-1888 is an out-of-bounds memory read vulnerability in HHVM's JSON decoder that occurs when processing backslash characters. This can cause denial of service (DoS) by crashing the HHVM process. Affected users include anyone running vulnerable HHVM versions to serve PHP applications.
💻 Affected Systems
- HHVM
📦 What is this software?
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through HHVM process crashes leading to sustained denial of service.
Likely Case
Intermittent service disruptions when malformed JSON triggers the vulnerability.
If Mitigated
Minimal impact with proper input validation and network segmentation.
🎯 Exploit Status
Exploitation requires sending malformed JSON to HHVM endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.7, 4.32.1, 4.38.1, 4.46.0 and later
Vendor Advisory: https://hhvm.com/blog/2020/02/20/security-update.html
Restart Required: Yes
Instructions:
1. Identify current HHVM version. 2. Upgrade to patched version. 3. Restart HHVM service. 4. Verify fix with test JSON payloads.
🔧 Temporary Workarounds
Input Validation Filter
allImplement JSON input validation to reject malformed data before HHVM processing.
# Implement in application code or web server configuration
Rate Limiting
allLimit request rates to reduce DoS impact potential.
# Configure in web server or load balancer
🧯 If You Can't Patch
- Implement WAF rules to block malformed JSON patterns
- Isolate HHVM instances behind reverse proxies with input filtering
🔍 How to Verify
Check if Vulnerable:
Check HHVM version against affected ranges: hhvm --versionCheck Version:
hhvm --versionVerify Fix Applied:
Test with controlled JSON payloads containing backslash sequences and monitor for crashes.📡 Detection & Monitoring
Log Indicators:
- HHVM process crashes
- Segmentation fault errors in logs
- Unexpected service restarts
Network Indicators:
- Spikes in malformed JSON requests
- Unusual backslash patterns in payloads
SIEM Query:
source="hhvm.log" AND ("segmentation fault" OR "crash" OR "SIGSEGV")