6 minhigh
All-Line Equipment Company Fuel-Boss (CVE-2018-19518, CVE-2019-11043)
CISA published an ICS advisory detailing two remote code execution vulnerabilities in All-Line Equipment Company Fuel-Boss V1 products running PHP 7.1.5 or earlier. CVE-2018-19518 exploits argument injection in PHP's imap_open() function to execute arbitrary OS commands. CVE-2019-11043 exploits a buffer overflow in PHP-FPM configurations to achieve remote code execution. Fixes are available for two of four product variants; the remaining two have no fix or no planned fix.
Sens:▲ 24hConf:high
Showing defanged values
- cveCVE-2018-19518Argument injection in imap_open() allows remote attackers to execute arbitrary OS commands via IMAP server names containing -oProxyCommand, and a stack-based buffer overflow may allow remote code execution.
- cveCVE-2019-11043Certain FPM configurations allow the FPM module to write past allocated buffers into FCGI protocol data space, creating a remote code execution condition.
Detection / Hunteropenrouter
What Happened
A government cybersecurity agency warned that certain industrial fuel management systems made by All-Line Equipment Company have serious security flaws. Attackers could exploit these flaws to run malicious code on the systems remotely. The affected products are used in critical sectors such as manufacturing, defense, emergency services, and transportation. Organizations using these products should contact the vendor for fixes where available, remove unfixed systems from the internet, and restrict network access to trusted IP addresses only.
Key Takeaways
- All-Line Equipment Company Fuel-Boss V1 products running PHP 7.1.5 or earlier are vulnerable to two CVEs enabling remote code execution.
- CVE-2018-19518 allows argument injection via imap_open() in PHP, enabling arbitrary OS command execution through crafted IMAP server names containing -oProxyCommand.
- CVE-2019-11043 allows remote code execution through certain PHP-FPM configurations that write past allocated buffers into FCGI protocol data space.
- Fixes are available only for Fuel-Boss V1 Standard and Portal variants; no fix is planned for Backflush Systems and fixes are pending for Master/Slave.
- Vendor recommends taking unfixed products off the internet or restricting access via IP filtering at the router level.
Affected Systems
- All-Line Equipment Company Fuel-Boss V1 Standard (PHP <= 7.1.5)
- All-Line Equipment Company Fuel-Boss V1 Portal (PHP <= 7.1.5)
- All-Line Equipment Company Fuel-Boss V1 Master/Slave (PHP <= 7.1.5)
- All-Line Equipment Company Fuel-Boss V1 Backflush Systems (PHP <= 7.1.5)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2018-19518 | University of Washington IMAP Toolkit 2007f (used in PHP imap_open()) | High | Argument injection in imap_open() allows remote attackers to execute arbitrary OS commands via IMAP server names containing -oProxyCommand, and a stack-based buffer overflow may allow remote code execution. |
| CVE-2019-11043 | PHP-FPM (PHP versions up to and including 7.1.5) | High | Certain FPM configurations allow the FPM module to write past allocated buffers into FCGI protocol data space, creating a remote code execution condition. |
Attack Chain
- Reconnaissance: Attacker identifies internet-exposed Fuel-Boss systems running PHP 7.1.5 or earlier
- Initial Access: Attacker exploits CVE-2018-19518 via crafted IMAP server name containing -oProxyCommand argument or CVE-2019-11043 via malicious PHP-FPM request
- Execution: Argument injection or buffer overflow triggers arbitrary OS command or code execution on the target system
- Persistence/Impact: Attacker gains remote code execution on industrial control system device
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisory. The article is a vulnerability notification with mitigation guidance only.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Fuel-Boss is an ICS product running embedded PHP. EDR agents are unlikely to be deployed on these devices, limiting endpoint telemetry. |
| Network Visibility | Medium | Network-based detection could identify exploitation attempts targeting PHP-FPM endpoints or imap_open() parameter injection if the traffic traverses monitored segments. |
| Detection Difficulty | Hard | ICS devices often lack host-based logging capabilities. Detection relies on network-level monitoring and web server logs which may not be available or centrally collected in OT environments. |
Required Log Sources
- Web server access logs (PHP-FPM/FastCGI requests)
- Network firewall logs for inbound connections to Fuel-Boss systems
- ICS/OT network traffic monitoring
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for inbound HTTP requests to Fuel-Boss systems that contain unusual IMAP server name parameters or -oProxyCommand strings, which would indicate CVE-2018-19518 exploitation attempts. | Web server access logs, network IDS signatures, reverse proxy logs | Initial Access | Low — legitimate IMAP configuration requests are unlikely to contain -oProxyCommand arguments. |
| Consider hunting for HTTP requests targeting PHP-FPM endpoints with oversized or malformed FastCGI parameters that could trigger the buffer overflow described in CVE-2019-11043. | Web server access logs, network IDS, PHP-FPM error logs | Initial Access | Medium — malformed FastCGI requests could occur from misconfigured clients or scanners. |
| Consider hunting for unexpected outbound connections or command execution originating from Fuel-Boss devices, which would indicate successful exploitation and post-compromise activity. | OT network flow data, firewall egress logs, ICS network monitoring | Execution | Low — Fuel-Boss devices should have predictable communication patterns in a properly segmented OT network. |
Control Gaps
- Network segmentation between IT and OT networks may not prevent exploitation if Fuel-Boss systems are internet-exposed
- Host-based detection on ICS devices is likely absent
- Web application firewalls may not inspect FastCGI protocol data for buffer overflow indicators
Key Behavioral Indicators
- Inbound HTTP requests to Fuel-Boss systems containing -oProxyCommand in IMAP-related parameters
- PHP-FPM requests with abnormally large or malformed parameters targeting buffer overflow conditions
- Unexpected outbound network connections from Fuel-Boss devices following potential exploitation
False Positive Assessment
Low — exploitation indicators such as -oProxyCommand in IMAP parameters and malformed FastCGI requests are unlikely in normal Fuel-Boss operation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider taking unfixed Fuel-Boss systems off the internet immediately and restricting access to trusted IP addresses at the router or firewall level.
- Contact All-Line Equipment Company at 866-356-3336 to obtain fixes for Fuel-Boss V1 Standard and V1 Portal variants if those products are in use.
- Inventory all Fuel-Boss deployments across your environment and identify which variants (Standard, Portal, Master/Slave, Backflush) are running and their PHP version.
Infrastructure Hardening
- Consider isolating Fuel-Boss and other ICS devices behind firewalls, separating them from business networks and internet exposure.
- If remote access is required, evaluate whether a VPN with current updates can be used instead of direct internet exposure.
- Consider deploying network IDS signatures for CVE-2018-19518 and CVE-2019-11043 exploitation patterns if your OT monitoring program supports it.
User Protection
- Consider implementing IP allowlisting at the network layer for any Fuel-Boss systems that must remain accessible.
- Evaluate whether PHP can be upgraded beyond 7.1.5 on affected systems, though this may require vendor validation for ICS compatibility.
Security Awareness
- Consider incorporating ICS vulnerability management into existing awareness programs, emphasizing that OT devices require the same patch and exposure management rigor as IT systems.
- If applicable, remind personnel that Fuel-Boss Backflush Systems have no planned fix and require compensating controls for the foreseeable future.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
Execution
Related
Stay currentSubscribe via RSS
