CVE-2024-1874: Command injection via array-ish $command parameter of proc_open()
Command injection via array-ish $command parameter of procopen()
Other sources
Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
— PHP
In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.29 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.8-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.18 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-9fcc-425m-g385
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1874?
CVE-2024-1874 has a critical severity level due to its potential for command injection vulnerabilities.
How do I fix CVE-2024-1874?
To fix CVE-2024-1874, upgrade PHP to version 8.1.29 or later, or to version 8.2.20 or later.
What versions of PHP are affected by CVE-2024-1874?
CVE-2024-1874 affects PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.5.
Can CVE-2024-1874 be exploited remotely?
Yes, CVE-2024-1874 can be exploited remotely if an attacker can send crafted commands to the affected PHP code.
What is proc_open() in the context of CVE-2024-1874?
In the context of CVE-2024-1874, proc_open() is a PHP function that creates a process based on command arguments which may lack sufficient escaping, leading to vulnerabilities.