PHP-CGI argument injection on Windows (CVE-2024-4577)

Updates on Jun 6, 2024

Summary

A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.

Advisories4

• GHSA-3qgc-jrrr-25jv: argument injection in PHP-CGIPHP (GitHub)
• PHP Group advisory: CVE-2024-4577PHP Group
• NVD: CVE-2024-4577NVD · Jun 9, 2024
• CISA Known Exploited Vulnerabilities CatalogCISA · Jun 12, 2024