CVE-2024-8927 cgi.force_redirect configuration is bypassable due to the environment variable collision

What is CVE-2024-8927?

CVE-2024-8927 is a high-severity vulnerability in Php Php, published on 8 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

Weakness: CWE-1220

Which versions are affected by CVE-2024-8927?

3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.

Products include Php Php.

How do I fix CVE-2024-8927?

Upgrade libphp to a fixed version for your release line: 8.1.30, 8.2.24 or 8.3.12.

Is CVE-2024-8927 being exploited?

There is no known exploitation of CVE-2024-8927 in the wild and no public exploit code.

Other vulnerabilities in Php Php

• CVE-2012-2688 Integer overflow in n/a Critical 10.0
• CVE-2012-2376 Memory corruption in n/a Critical 10.0
• CVE-2011-3268 Memory corruption in n/a Critical 10.0
• CVE-2009-4143 Other in n/a Critical 10.0
• CVE-2008-5557 Memory corruption in n/a Critical 10.0

All Php Php vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-50132, AZL-50164, BELL-CVE-2024-8927, BIT-libphp-2024-8927, BIT-php-2024-8927, BIT-php-min-2024-8927 and 10 more.