Azure App Service (Windows) - PHP 5.6.40 visible in Kudu for .NET Framework application, security exposure concern

The php.exe version reported by Kudu does not by itself establish that your .NET Framework site can process public requests through PHP; verify that PHP is not selected in the app configuration and that no *.php IIS handler mapping or PHP content exists, then treat the platform binary as Microsoft-managed rather than attempting to remove it.

Exposure assessment

• Worker-image ownership: Windows App Service is PaaS. Azure manages the operating system and built-in application stack; customers manage their application and data. Built-in frameworks may exist on the worker regardless of the framework selected by a particular app, and Azure updates platform-provided components.^1^ ^2^
• Request routing: The presence of php.exe on PATH is not equivalent to PHP being registered as an HTTP request handler. IIS processes PHP requests through a handler mapping—normally *.php mapped to a PHP FastCGI executable.^3^ App Service likewise documents handler mappings as the mechanism that associates an extension such as *.php with a script processor.^4^
• Kudu execution: An authorized Kudu user can run commands, including php -v; that is expected management functionality, not anonymous access to PHP. Kudu is a companion SCM application that supports command execution, deployment, diagnostics, and a REST API. Browser access through Microsoft Entra ID requires a role containing Microsoft.Web/sites/publish/Action.^5^

Consequently, an unused binary is not sufficient evidence that a PHP CVE is exploitable through the public application endpoint. A definitive CVE determination still depends on the vulnerability’s attack prerequisites and whether any reachable code path invokes the affected PHP component.

Verify that PHP is inactive

1. Query the app’s configured PHP version:

      az webapp config show \
        --resource-group <resource-group> \
        --name <app-name> \
        --query phpVersion
   

   Repeat with --slot <slot-name> for every deployment slot. Microsoft documents this property separately from running php --version in Kudu.^6^
2. In Azure portal → App Service → Settings → Configuration → Path mappings, verify there is no handler whose extension is *.php and whose script processor points to php-cgi.exe.
3. Inspect the deployed web.config, including configuration transforms, for *.php, FastCgiModule, php-cgi.exe, or inherited/custom handler entries.
4. Search each slot’s deployed content and deployment package for .php, composer.json, composer.phar, and custom deployment scripts that invoke PHP.

If these checks show no configured PHP stack, no PHP handler, no PHP content, and no deployment/startup code invoking PHP, there is no documented HTTP route that would pass ordinary requests from the .NET site to PHP.

Removal and updating

Do not delete or replace the platform copy from Kudu. App Service manages the OS and built-in runtimes, and application code has only low-privileged access to common OS files.^2^ There is no documented customer control for selectively removing the built-in PHP binary from a managed Windows worker.

PHP on Windows App Service reached end of support in November 2022; current PHP support is Linux-only.^6^ The 2020 announcement confirms that Azure’s PHP 5.6.40 build then included Microsoft security backports, but that historical statement should not be treated as assurance that every later PHP vulnerability was backported.^7^

The current critical-PHP notice concerns App Service on Linux, its built-in PHP images, and active PHP workloads; it does not state that an inactive Windows worker binary creates exposure for .NET applications.^8^

Recommended hardening

1. Restrict the SCM site independently at App Service → Settings → Networking → Public network access → Access restrictions. Configure the SCM site rules or select Use main site rules.^9^
2. Disable SCM basic authentication and use Microsoft Entra authentication.^10^
3. Grant Kudu access only to identities requiring deployment or diagnostics, using a least-privilege role containing Microsoft.Web/sites/publish/Action, rather than broad Owner/Contributor access.^5^
4. If an audit requires confirmation for a particular CVE, open an Azure support request containing the CVE IDs, app region, Windows App Service plan/worker details, and the results of the configuration checks above. Public documentation does not provide a CVE-by-CVE applicability statement for the residual Windows PHP 5.6.40 binary.

References

1. Azure App Service OS and runtime patching
2. Operating system functionality in Azure App Service
3. FastCGI <fastCgi>
4. Configure an App Service app
5. Kudu service overview - Azure App Service | Microsoft Learn
6. Configure a PHP App - Azure App Service | Microsoft Learn
7. PHP Minor Version Update for July 2020
8. Critical PHP Security Release: What It Means for Azure App Service on Linux
9. Set up Azure App Service access restrictions
10. Secure your Azure App Service deployment