PHP-CGI OS Command Injection (CVE-2024-4577) #shorts #breaking

CVE

This CVE, numbered CVE-2024-4577, pertains to PHP-CGI OS Command Injection. It is a recent vulnerability, but not classified as a zero-day exploit. The exploit tools used were developed by Watchtwr Labs. This vulnerability has primarily affected users of PHP and XAMPP. It impacts PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8 on Windows systems running Apache and PHP-CGI. Users of these specific PHP versions on Windows servers need to be aware, especially if they are utilizing XAMPP. This vulnerability allows an attacker to inject commands into the PHP binary being executed, potentially exposing the source code of scripts and even executing arbitrary PHP code on the server. This can lead to severe security breaches if exploited.

Watch the full video on YouTube: CVE-2024-4577

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2024-4577
Description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Provider
php
CWE / problem types
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Software Versions
PHP Group:PHP:[{'lessThan': '8.1.29', 'status': 'affected', 'version': '8.1.*', 'versionType': 'semver'}, {'lessThan': '8.2.20', 'status': 'affected', 'version': '8.2.*', 'versionType': 'semver'}, {'lessThan': '8.3.8', 'status': 'affected', 'version': '8.3.*', 'versionType': 'semver'}]
Date Published
2024-06-09T19:42:36.464Z
Last Updated
2025-03-14T01:24:54.997Z