CVE-2024-4577
PHP-CGI OS Command Injection Vulnerability
Description
CVE-2024-4577 is a critical argument injection vulnerability in PHP when running in CGI mode on Windows with Apache. The flaw exploits Windows "Best-Fit" character mapping behavior to bypass previous mitigations for CVE-2012-1823, allowing unauthenticated remote attackers to execute arbitrary code on the server. With a CVSS v3.1 score of 9.8 and an EPSS score of 94.37% at the 100th percentile, this is one of the most actively exploited vulnerabilities of 2024. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 3, 2024 and confirmed a Known ransomware association, making it an emergency patching priority for any PHP installation on Windows.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| php | php | >= 8.1.0, < 8.1.29; >= 8.2.0, < 8.2.20; >= 8.3.0, < 8.3.8 |
| fedoraproject | fedora | 39; 40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2024/06/07/1(Mailing List, Third Party Advisory)
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/(Exploit, Press/Media Coverage, Third Party Advisory)
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html(Third Party Advisory)
- https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately(Third Party Advisory)
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/(Exploit, Third Party Advisory)
- https://github.com/11whoami99/CVE-2024-4577(Exploit)
- https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv(Exploit, Third Party Advisory)
- https://github.com/rapid7/metasploit-framework/pull/19247(Exploit, Issue Tracking, Patch)
- https://github.com/watchtowrlabs/CVE-2024-4577(Exploit, Third Party Advisory)
- https://github.com/xcanwin/CVE-2024-4577-PHP-RCE(Exploit, Third Party Advisory)
- https://isc.sans.edu/diary/30994(Exploit, Third Party Advisory)
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/(Exploit, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/(Mailing List)
- https://security.netapp.com/advisory/ntap-20240621-0008/(Third Party Advisory)
- https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/(Third Party Advisory)
- https://www.php.net/ChangeLog-8.php#8.1.29(Release Notes)
- https://www.php.net/ChangeLog-8.php#8.2.20(Release Notes)
- https://www.php.net/ChangeLog-8.php#8.3.8(Release Notes)
- https://blog.talosintelligence.com/new-persistent-attacks-japan/(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-4577, but the vulnerability is an argument injection flaw that typically corresponds to CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The root cause lies in the interaction between Windows code page handling and PHP-CGI argument parsing. When Windows is configured to use certain code pages (particularly those for Chinese, Japanese, and other East Asian languages), the Windows "Best-Fit" character mapping feature converts specific Unicode characters into ASCII equivalents, including the hyphen character. PHP-CGI interprets these converted characters as command-line options, allowing an attacker to inject arbitrary PHP interpreter flags through HTTP query strings.
Impact Analysis
CVE-2024-4577 allows an unauthenticated remote attacker to execute arbitrary code on any Windows server running PHP in CGI mode with Apache. The CVSS vector shows a Network attack (AV:N) with Low complexity (AC:L), No privileges required (PR:N), and No user interaction needed (UI:N). Confidentiality (High): the attacker can read any file accessible to the PHP process, including source code, configuration files with database credentials, environment variables, and data from connected databases. Integrity (High): the attacker can write files to the web server, modify existing PHP scripts, inject backdoors, and alter database content. Availability (High): the attacker can shut down the web server, consume all system resources, encrypt files, or destroy data. The EPSS score of 94.37% at the 100th percentile makes this the most probable vulnerability to be exploited across all tracked CVEs. CISA has confirmed a Known ransomware association, meaning ransomware groups are actively leveraging this vulnerability for initial access and payload delivery. Research by Talos Intelligence documented persistent attacks against Japanese organizations using CVE-2024-4577, and the vulnerability is particularly dangerous on systems configured with East Asian locale code pages.
Exploit Maturity
CVE-2024-4577 has one of the most extensive exploit landscapes of any vulnerability in 2024. Multiple public exploits are available on GitHub, including integration into the Metasploit framework. The original researcher Orange Tsai published a detailed technical writeup of the vulnerability. CISA added it to the KEV catalog with a remediation deadline of July 3, 2024 and confirmed Known ransomware association. The EPSS score of 94.37% at the 100th percentile indicates mass automated exploitation across the internet. Multiple security organizations have published analyses including watchTowr Labs, DEVCORE, and SANS ISC. The PHP project released the security advisory GHSA-3qgc-jrrr-25jv with full details. Active exploitation campaigns have been observed targeting organizations worldwide, with particular focus on Japanese infrastructure.
Remediation
-
Update PHP immediately to version 8.1.29, 8.2.20, or 8.3.8 (or later) depending on your PHP branch. The patches are available from php.net and through your operating system's package manager. This is an emergency-priority update due to the confirmed ransomware association.
-
Migrate away from PHP-CGI mode to PHP-FPM (FastCGI Process Manager) if possible. PHP-FPM is not affected by this class of argument injection vulnerability and provides better performance and security characteristics. If CGI mode must be retained, ensure it is running the patched PHP version.
-
Implement URL rewrite rules as an immediate temporary mitigation if patching cannot be performed right away. Block requests containing certain URL-encoded characters that trigger the Windows Best-Fit mapping exploitation path. Apache mod_rewrite rules can filter malicious query strings before they reach PHP-CGI.
-
Audit all Windows PHP servers for indicators of compromise by checking for newly created files in web-accessible directories, unexpected PHP configurations, unauthorized user accounts, and network connections to known command-and-control infrastructure. Given the mass exploitation and ransomware association, assume compromise if the system was exposed while unpatched.
-
Review Windows locale and code page settings on servers running PHP-CGI. Systems configured with East Asian code pages (Chinese Simplified, Chinese Traditional, Japanese) are at highest risk, but all Windows PHP-CGI installations should be treated as vulnerable and patched regardless of locale configuration.
Technical Details
CVE-2024-4577 is an argument injection vulnerability in PHP on Windows with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a score of 9.8 (Critical). The Attack Vector is Network (AV:N), exploited through HTTP requests. Attack Complexity is Low (AC:L), No privileges (PR:N) and No user interaction (UI:N) are required. All three impact metrics are High, and the Scope is Unchanged (S:U). The vulnerability is a bypass of the CVE-2012-1823 fix that prevented passing command-line arguments to PHP-CGI through query strings. The original fix blocked the standard ASCII hyphen (-) character in query strings when PHP ran in CGI mode. However, Windows uses a "Best-Fit" character mapping mechanism when converting Unicode to ASCII for certain code pages. This mechanism maps specific Unicode characters (such as the soft hyphen U+00AD) to the standard ASCII hyphen. An attacker can send HTTP requests with these Unicode characters in the query string, which Windows transparently converts to hyphens before passing them to PHP-CGI, effectively bypassing the CVE-2012-1823 mitigation. Once the attacker can pass arbitrary arguments to the PHP interpreter, they can use flags like -d to modify PHP configuration directives at runtime, enabling arbitrary code execution. Affected PHP versions include 8.1.x before 8.1.29, 8.2.x before 8.2.20, and 8.3.x before 8.3.8.
Frequently Asked Questions
Is CVE-2024-4577 being actively exploited?
Yes. CVE-2024-4577 is one of the most actively exploited vulnerabilities of 2024. CISA confirmed active exploitation and a Known ransomware association. Its EPSS score of 94.37% at the 100th percentile indicates it is among the most probable vulnerabilities to be exploited. Multiple public exploits exist, including Metasploit integration.
Is CVE-2024-4577 used in ransomware attacks?
Yes. CISA has explicitly confirmed a Known ransomware association for CVE-2024-4577. Ransomware groups are using this vulnerability for initial access to Windows servers running PHP, making it an emergency patching priority.
What PHP versions are affected by CVE-2024-4577?
PHP versions 8.1.x before 8.1.29, 8.2.x before 8.2.20, and 8.3.x before 8.3.8 are affected when running in CGI mode on Windows with Apache. The vulnerability is specific to the PHP-CGI configuration on Windows systems.
How do I fix CVE-2024-4577?
Update PHP to version 8.1.29, 8.2.20, or 8.3.8 or later. Alternatively, migrate from PHP-CGI to PHP-FPM, which is not vulnerable to this class of attack. As a temporary mitigation, implement Apache URL rewrite rules to block malicious query string characters.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.