A critical vulnerability impacting the PHP-CGI service, identified by the references CVE-2024-4577, has been published. It has been assigned a respective CVSS 3.1 score of 9.8. It must be noted that there are multiple proofs of concept easily available online and many exploitations have already been reported.
This CVE-2024-4577 vulnerability exists since 2012 and was inserted during the CVE-2012-1823 fix.
Technical details of PHP-CGI vulnerability
The CVE-2024-4577 allows an attacker to remotely execute malicious commands on Windows servers that are hosting a PHP system, through the PHP-CGI script engine. It can be exploited even if PHP is not configured in CGI mode. The PHP-CGI module is embedded in IIS web servers and XAMPP serveurs.
The impacted versions are:
- 1.x before 8.1.29,
- 2.x before 8.2.20,
- 3.x before 8.3.8,
- x to 8.0.x (outdated versions).
This vulnerability can be exploited by inserting a “Soft-Hyphen” character inside an URL. It is converted automatically as a hyphen by the Windows “Best-fit” mapping. It allows to bypass sanitizations done by PHP and makes it run some code through the “php.exe” executable.
By now, only Windows servers with japanese and chinese (simplified and traditional) are confirmed to be vulnerable. Otherwise, the result is still unknown. But global exploit attempts have already been reported.
Attack modelling with MITRE ATT&CK
MITRE ATT&CK
- T1190 (Exploit Public-Facing Application)
IoC
The attack can be detected by looking for a « Soft-Hyphen » character (%AD encoded) inside a HTTP request URL. For exemple :
https://example.com/test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
PHP-CGI vulnerability: Stormshield Network Security protections
Protection to face CVE-2024-4577
Firewall Stormshield Network Security (SNS) detect and block any CVE-2024-4577 exploit attempts by using its IPS HTTP protocol inspection. This requires the SSL trafic to be decrypted.
- http:82 : Bad UTF-8 encoding in URL
Confidence index for the protection offered by Stormshield |
Confidence index for the absence of false positives |
Recommandations regarding the PHP-CGI vulnerability
It is strongly recommended to update PHP (or its affiliated services) to the following versions:
- 8.1.29
- 8.2.20
- 8.3.8
The original advisory can be found here: openwall.com/lists/oss-security/2024/06/07/1
