CVE-2024-4577

Name of the Vulnerable Software and Affected Versions PHP versions 8.1.0 through 8.1.28 PHP versions 8.2.0 through 8.2.19 PHP versions 8.3.0 through 8.3.7

Description An OS command injection flaw exists in the PHP CGI module on Windows when used with Apache. The issue arises because the Windows implementation of PHP does not account for "Best-Fit" behavior, where Unicode characters are converted to the closest matching ANSI characters. A remote attacker can send specially crafted HTTP requests containing specific character sequences that the php-cgi module misinterprets as PHP options. This allows the attacker to pass arbitrary options to the PHP binary, potentially leading to the disclosure of script source code or remote code execution (RCE) on the server.

Real-world exploitation has been widespread, with reports of attacks targeting organizations in Japan, the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain, and Malaysia. Incidents include the breach of a Japanese hosting provider affecting approximately 26,000 servers and the compromise of 25 US government-affiliated servers. Attackers have used this flaw to deploy Quasar RAT, XMRig cryptocurrency miners, and Cobalt Strike TaoWu plugins, often following up with kernel-level exploits to escalate privileges from www-data to root.

Recommendations Update PHP to version 8.1.29, 8.2.20, or 8.3.8 respectively. As a temporary mitigation, disable the session.upload progress setting in php.ini. Disable the use of PHP-CGI on internet-facing servers. Restrict the use of administrative tools and implement kernel module signing to prevent privilege escalation.