CVE-2024-4577 PHP-CGI OS Command Injection
Attackers can execute arbitrary code or read source code via argument injection in PHP-CGI on Windows with specific code pages.
- Exploited in the wild
- Since 12 Jun 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4577?
CVE-2024-4577 is a critical command injection vulnerability in Fedoraproject Fedora, published on 9 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Weakness: CWE-78
Which versions are affected by CVE-2024-4577?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.29, 8.2.20, 8.3.8 |
php Bitnami | All versions | 8.1.29, 8.2.20, 8.3.8 |
php-min Bitnami | All versions | 8.1.29, 8.2.20, 8.3.8 |
Products include Fedoraproject Fedora, Php Php.
How do I fix CVE-2024-4577?
Upgrade libphp to a fixed version for your release line: 8.1.29, 8.2.20 or 8.3.8. US federal agencies must fix it by 3 Jul 2024.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-4577 being exploited?
Yes. Attackers have exploited CVE-2024-4577 in the wild since at least 12 Jun 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 71 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-42424, AZL-42433, BIT-libphp-2024-4577, BIT-php-2024-4577, BIT-php-min-2024-4577, ECHO-96a3-1302-f796 and 2 more.