PHP/XAMPP - RCE (CVE-2024-4577)
Description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
psychologyCrowdSec Analysis
CVE-2024-4577 is a critical vulnerability affecting PHP installations using Apache with PHP-CGI on Windows. It arises from improper handling of command-line arguments when certain system code pages are in use, allowing attackers to manipulate input and potentially force the execution of arbitrary PHP code or leak sensitive script source code.
CrowdSec has been tracking this vulnerability and its exploits since 10th of June 2024.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2024-4577 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-4577 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Detection patterns commonly involve crafted requests aiming to exploit PHP-CGI processing quirks on affected systems.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-06-09 |
| Rule Released | 2024-06-10 |
| CrowdSec First Seen | 2024-06-10 |
| CISA KEV | 2024-06-12 |
| CISA Remediation Deadline | 2024-07-03 |
Related Weaknesses
Remediation & Protection
External References
- https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
- https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
- https://github.com/11whoami99/CVE-2024-4577
- https://github.com/xcanwin/CVE-2024-4577-PHP-RCE
- https://github.com/rapid7/metasploit-framework/pull/19247
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
- https://github.com/watchtowrlabs/CVE-2024-4577
- https://www.php.net/ChangeLog-8.php#8.1.29
- https://www.php.net/ChangeLog-8.php#8.2.20
- https://www.php.net/ChangeLog-8.php#8.3.8
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- https://security.netapp.com/advisory/ntap-20240621-0008/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml
- https://blog.talosintelligence.com/new-persistent-attacks-japan/
- https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577
- https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577