CVE-2024-4577

Name of the Vulnerable Software and Affected Versions PHP versions 8.1.0 through 8.1.28 PHP versions 8.2.0 through 8.2.19 PHP versions 8.3.0 through 8.3.7

Description An OS command injection flaw exists in the PHP CGI module on Windows when used with Apache. The issue arises because the Windows implementation of PHP does not account for Best-Fit behavior, where Unicode characters are converted to the closest matching ANSI characters. A remote attacker can send a specially crafted HTTP request containing specific character sequences that the php-cgi module misinterprets as PHP options. This allows the attacker to pass arbitrary options to the PHP binary, potentially revealing script source code or executing arbitrary PHP code on the server. Real-world exploitation has been observed globally, including a massive breach at the Japanese hosting provider Onamae affecting approximately 26,000 servers, as well as attacks in the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain, and Malaysia. Attackers have used this flaw to deploy Quasar RAT, XMRig cryptocurrency miners, and Cobalt Strike TaoWu plugins to gain system privileges and maintain persistence.

Recommendations Update PHP to version 8.1.29. Update PHP to version 8.2.20. Update PHP to version 8.3.8. As a temporary mitigation, disable the session.upload progress setting in the php.ini file. Disable the expose php directive and restrict the disable functions list in php.ini to harden the server against host takeover.