erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record · Known exploited

CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability

Exploited in the wild (CISA KEV). In PHP versions 8.1.

CISA KEV · added 2024-06-12 CVSS 9.8 Critical EPSS 100.0% · p100.0 Act now

Updated By erroneo.us Security Desk26 references Seen in the digest for Jun 12, 2024

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Yes, if you run PHP Group PHP. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2024-06-12, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2024-07-03; treat that as the outer limit, not the target. CISA also lists it as known to be used in ransomware campaigns.
  • EPSS 100.0%, percentile 100.0: FIRST’s model estimates a 100.0% chance of exploitation activity in the next 30 days, higher than 100.0% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
  • Editorial verdict: Act now. CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows — If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.

What it is

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

CISA’s summary

PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

Weakness type: CWE-78.

Product: PHP Group PHP · Assigned by: php · Published: 2024-06-09

Affected and fixed versions

VendorProductAffected versions (per CVE record)
PHP GroupPHP8.1.* < 8.1.29, 8.2.* < 8.2.20, 8.3.* < 8.3.8

Severity scores

Scored byCVSSScoreVector
php3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack vector: network (remotely reachable)
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: none
  • Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: added 2024-06-12; federal due date 2024-07-03. Known ransomware use: Known.
  • CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • CISA SSVC assessment: exploitation active, automatable yes, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 99.99% probability of exploitation activity in the next 30 days; percentile 100.0.

Timeline

  • — erroneo.us brief: CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows
  • — CVE record published by php
  • — Added to CISA’s Known Exploited Vulnerabilities catalog
  • — CISA remediation deadline for US federal agencies
  • — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. Listed in CISA KEV notes (php.net) php.net

Vulnerability records

  1. CVE.org record CVE-2024-4577 cve.org
  2. NVD entry CVE-2024-4577 nvd.nist.gov

Government

  1. CISA Known Exploited Vulnerabilities catalog entry cisa.gov

Other references from the CVE record and advisory

  1. github.com github.com
  2. blog.orange.tw blog.orange.tw
  3. devco.re devco.re
  4. arstechnica.com arstechnica.com
  5. imperva.com imperva.com
  6. github.com github.com
  7. github.com github.com
  8. github.com github.com
  9. labs.watchtowr.com labs.watchtowr.com
  10. github.com github.com
  11. php.net php.net
  12. php.net php.net
  13. php.net php.net
  14. cert.be cert.be
  15. isc.sans.edu isc.sans.edu
  16. openwall.com openwall.com
  17. lists.fedoraproject.org lists.fedoraproject.org
  18. lists.fedoraproject.org lists.fedoraproject.org
  19. security.netapp.com security.netapp.com
  20. vicarius.io vicarius.io
  21. vicarius.io vicarius.io
  22. blog.talosintelligence.com blog.talosintelligence.com

All exploited PHP Group vulnerabilities · Today’s Security Digest