CVE-2024-5585: Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
Command injection via array-ish $command parameter of procopen() (bypass CVE-2024-1874 fix)
Other sources
Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
— PHP
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.29 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-9fcc-425m-g385 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.8
Event History
Frequently Asked Questions
What are the affected versions for CVE-2024-5585?
CVE-2024-5585 affects PHP versions 8.1.0 to 8.1.28, 8.2.0 to 8.2.19, and 8.3.0 to 8.3.7.
What is the severity of CVE-2024-5585?
CVE-2024-5585 has not been officially assigned a severity rating, but it represents a critical command execution vulnerability.
How do I fix CVE-2024-5585?
To fix CVE-2024-5585, upgrade PHP to versions 8.1.29, 8.2.20, or 8.3.8 or later.
What is the nature of the vulnerability in CVE-2024-5585?
CVE-2024-5585 allows for a bypass of previous fixes if command names include trailing spaces when using proc_open().
Is there a workaround for CVE-2024-5585?
There is no specific workaround for CVE-2024-5585; upgrading to a fixed PHP version is the recommended solution.