CVE-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
Attackers can execute arbitrary commands on Windows systems via proc_open() if they control command arguments, bypassing previous security fixes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5585?
CVE-2024-5585 is a high-severity command injection vulnerability in Fedoraproject Fedora, published on 9 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Which versions are affected by CVE-2024-5585?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.29, 8.2.20, 8.3.8 |
php Bitnami | All versions | 8.1.29, 8.2.20, 8.3.8 |
php-min Bitnami | All versions | 8.1.29, 8.2.20, 8.3.8 |
Products include Fedoraproject Fedora, Php Php.
How do I fix CVE-2024-5585?
Upgrade libphp to a fixed version for your release line: 8.1.29, 8.2.20 or 8.3.8.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-5585 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5585 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-42427, AZL-42439, BIT-libphp-2024-5585, BIT-php-2024-5585, BIT-php-min-2024-5585, GHSA-9fcc-425m-g385.