# CVE-2024-4577: PHP/XAMPP - RCE

> Live exploitation tracking for CVE-2024-4577 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-4577

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** PHP
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** windows, php

## Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

## CrowdSec analysis

[CVE-2024-4577](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-4577) is a critical vulnerability affecting PHP installations using Apache with PHP-CGI on Windows. It arises from improper handling of command-line arguments when certain system code pages are in use, allowing attackers to manipulate input and potentially force the execution of arbitrary PHP code or leak sensitive script source code.

CrowdSec has been tracking this vulnerability and its exploits since 10th of June 2024.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2024-4577 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-4577 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Detection patterns commonly involve crafted requests aiming to exploit PHP-CGI processing quirks on affected systems.

## Timeline

- 2024-06-09: CVE Published. CVE-2024-4577 is published to NVD.
- 2024-06-10: Rule Released. CrowdSec releases a rule to detect CVE-2024-4577 exploitation attempts against the CrowdSec Network.
- 2024-06-10: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-4577 for the first time.
- 2024-06-12: CISA KEV. CVE-2024-4577 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-07-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
- https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
- https://github.com/11whoami99/CVE-2024-4577
- https://github.com/xcanwin/CVE-2024-4577-PHP-RCE
- https://github.com/rapid7/metasploit-framework/pull/19247
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
- https://github.com/watchtowrlabs/CVE-2024-4577
- https://www.php.net/ChangeLog-8.php#8.1.29
- https://www.php.net/ChangeLog-8.php#8.2.20
- https://www.php.net/ChangeLog-8.php#8.3.8
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- https://security.netapp.com/advisory/ntap-20240621-0008/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml
- https://blog.talosintelligence.com/new-persistent-attacks-japan/
- https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577
- https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-4577) follows observed exploitation activity for CVE-2024-4577. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.