erroneo.us
Search all guides⌘K

Security Digest · Jun 6, 2024 · Vulnerability · Language runtime

CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows

Windows PHP-CGI (incl. default XAMPP) allows unauthenticated RCE; fixed in 8.3.8/8.2.20/8.1.29. In KEV, used by ransomware. Patch or drop CGI now.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Act now

If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.

Who must act: Operators of Windows servers running PHP through php-cgi.exe (Apache CGI mode, XAMPP's default /php-cgi/ alias, or php binaries in a web-reachable CGI directory), especially on Chinese or Japanese system locales.

Who can relax: Linux and macOS PHP hosts, and Windows hosts using mod_php, FastCGI or PHP-FPM rather than PHP-CGI, are not affected by this bug.

Affected
PHP 8.1.x before 8.1.29 on Windows (CGI mode)
PHP 8.2.x before 8.2.20 on Windows (CGI mode)
PHP 8.3.x before 8.3.8 on Windows (CGI mode)
End-of-life PHP 8.0, 7.x and 5.x on Windows (no fix)
XAMPP for Windows default configuration
Fixed in
PHP 8.3.8
PHP 8.2.20
PHP 8.1.29 (8.1 is now end-of-life; move to a supported branch)
CVSS
9.8 (v3.1, NVD)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory Windows hosts running PHP and check `php -v` and whether php-cgi.exe is reachable over HTTP
  2. Upgrade to a supported PHP branch (8.2 or later) at or above the fixed releases
  3. On XAMPP, comment out the `ScriptAlias /php-cgi/` line in httpd-xampp.conf if you do not need PHP-CGI
  4. Migrate off PHP-CGI to mod_php, FastCGI or PHP-FPM
  5. If you cannot patch immediately, add DEVCORE's mod_rewrite rule blocking query strings that begin with %ad

How to check if you are affected or compromised

  • Search Apache access logs for requests to php-cgi paths with query strings starting with %AD or containing -d allow_url_include or auto_prepend_file
  • Look for mshta.exe or unexpected child processes spawned by httpd.exe or php-cgi.exe
  • Check for unfamiliar PHP files in the web root and ransom notes or encrypted files (TellYouThePass)

What happened#

On June 6, 2024 PHP shipped 8.3.8, 8.2.20 and 8.1.29 to fix an argument injection flaw in PHP-CGI on Windows, and DEVCORE, which reported it on May 7, published its alert the same day. The bug bypasses the protection added for CVE-2012-1823. Windows "Best-Fit" character conversion can turn certain characters in the command line into a hyphen, so PHP-CGI ends up reading attacker-controlled query string data as command-line options. NVD's description says this can reveal source code or run arbitrary PHP code. NVD and the PHP CNA both score it CVSS 3.1 9.8.

Exploitation followed within days. Imperva observed attacks from June 8 that delivered TellYouThePass ransomware: the injected PHP launched an HTA payload through mshta.exe, which loaded a .NET encryptor in memory. CISA added the CVE to the KEV catalog on June 12, 2024 with a July 3 federal due date. As of October 21, 2026 the KEV entry marks known ransomware campaign use as "Known."

Who is affected#

Per the PHP advisory, affected versions are 8.1 before 8.1.29, 8.2 before 8.2.20 and 8.3 before 8.3.8, and only on Windows. End-of-life branches (8.0, 7, 5) received no fix. DEVCORE confirmed direct exploitation on systems using the Traditional Chinese (950), Simplified Chinese (936) and Japanese (932) code pages. For other locales, including English, it could not rule out every scenario, so do not treat an English locale as a safe harbor. Exposure requires PHP running as CGI: Apache with php-cgi.exe, or the PHP binary in a web-reachable CGI directory. DEVCORE noted that XAMPP for Windows maps /php-cgi/ by default, which made every default Windows XAMPP install vulnerable.

Do you really need to act?#

For a narrow group, yes, immediately. The bug is unauthenticated, remotely triggerable with a single HTTP request, publicly documented and in active use by ransomware crews. If that describes your server and it was unpatched for any length of time since June 2024, assume someone has tried it.

For most PHP shops, no. Linux hosts, PHP-FPM, FastCGI and mod_php setups are not exposed. Note too that 8.1 is no longer listed on PHP's supported versions page. "Patched to 8.1.29" stops the bug but leaves you on an unsupported branch.

What to do now#

  1. Find Windows PHP hosts: run php -v and check your Apache config for ScriptAlias or Action directives pointing at php-cgi.exe.
  2. Upgrade to a supported branch (8.2 or later) at or above the fixed releases.
  3. On XAMPP, comment out ScriptAlias /php-cgi/ in httpd-xampp.conf unless you truly need it.
  4. Move off CGI to mod_php, FastCGI or PHP-FPM. DEVCORE calls PHP-CGI outdated and problematic.
  5. As a stopgap, apply DEVCORE's mod_rewrite rule rejecting query strings that begin with %ad.

How to tell if you were hit#

Grep Apache access logs for requests to php-cgi paths whose query string starts with %AD or carries options such as allow_url_include or auto_prepend_file. On the host, look for mshta.exe or shells spawned by httpd.exe or php-cgi.exe, new PHP files in the web root, and TellYouThePass ransom notes. If you find any of these, rebuild the host rather than clean it.

Timeline#

  • — DEVCORE reports the issue to PHP, which confirms it the same day.
  • — PHP 8.3.8, 8.2.20 and 8.1.29 released. DEVCORE publishes its alert.
  • — Imperva sees TellYouThePass ransomware exploiting the bug.
  • — CVE published in NVD.
  • — CISA adds CVE-2024-4577 to KEV.

Vulnerability records

  • CVE-2024-4577 · KEV 2024-06-12 · In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. NVD — CVE-2024-4577 nvd.nist.gov
  2. PHP (GitHub) — GHSA-3qgc-jrrr-25jv: Argument Injection in PHP-CGI github.com
  3. DEVCORE — Security Alert: CVE-2024-4577 PHP CGI Argument Injection Vulnerability devco.re
  4. CISA — Known Exploited Vulnerabilities Catalog cisa.gov
  5. Imperva — CVE-2024-4577 Quickly Weaponized to Distribute TellYouThePass Ransomware imperva.com
  6. PHP — Supported Versions php.net