CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability
Argument Injection in PHP-CGI
Other sources
Fixed bug (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
— PHP
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
— MITRE
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.8 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.29 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.12 - Upgrade
Upgrade
PHP-CGI (Windows)to a version that resolves this vulnerability.Fixed in 8.1.29 - Upgrade
Upgrade
PHP-CGI (Windows)to a version that resolves this vulnerability.Fixed in 8.2.20 - Upgrade
Upgrade
PHP-CGI (Windows)to a version that resolves this vulnerability.Fixed in 8.3.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-3qgc-jrrr-25jv
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4577?
CVE-2024-4577 is classified as a critical vulnerability affecting multiple PHP versions.
How do I fix CVE-2024-4577?
To fix CVE-2024-4577, upgrade PHP to versions 8.1.29, 8.2.20, or 8.3.8 or later.
Which versions of PHP are affected by CVE-2024-4577?
CVE-2024-4577 affects PHP versions 8.1.0 to 8.1.28, 8.2.0 to 8.2.19, and 8.3.0 to 8.3.7.
What is the impact of CVE-2024-4577?
The impact of CVE-2024-4577 includes potential parameter injection vulnerabilities leading to remote code execution.
Is CVE-2024-4577 present in Fedora 39 and 40?
Yes, CVE-2024-4577 can affect PHP installations in Fedora 39 and 40 that are running the vulnerable PHP versions.