CVE-2024-8927: cgi.force_redirect configuration is bypassable due to the environment variable collision
According to https://www.php.net/manual/en/security.cgi-bin.force-redirect.php, the configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL like http://host.example/cgi-bin/php/secretdir/script.php. The default value of cgi.forceredirect is 1.
But there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.
Other sources
cgi.forceredirect configuration is bypassable due to the environment variable collision
— Microsoft
In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.forceredirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.12 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u8 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.26-1~deb12u1Fixed in 8.2.28-1~deb12u1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.30 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.24 - Configuration
Ensure cgi.force_redirect is set to 1 (default value is 1), because in affected versions the HTTP_REDIRECT_STATUS environment variable collision can cause cgi.force_redirect not to be correctly applied in certain configurations.
PHP cgi.force_redirect = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8927?
CVE-2024-8927 has a high severity due to its potential to allow unauthorized access to PHP scripts.
How do I fix CVE-2024-8927?
To fix CVE-2024-8927, update PHP to versions 8.3.12, 8.2.26-1~deb12u1, or 8.2.27 as appropriate.
Which versions of PHP are affected by CVE-2024-8927?
CVE-2024-8927 affects PHP versions from 8.1.0 to 8.1.30, 8.2.0 to 8.2.24, and from 8.3.0 to 8.3.12.
What configuration settings can mitigate CVE-2024-8927?
Setting cgi.force_redirect to a value that restricts access can mitigate the risks associated with CVE-2024-8927.
Is CVE-2024-8927 related to other PHP vulnerabilities?
Yes, CVE-2024-8927 is related to previous vulnerabilities affecting PHP’s handling of CGI scripts.