Vulnerability Card

CVE-2024-4577, also known as the PHP CGI Windows Remote Code Execution Vulnerability, is a critical vulnerability affecting the PHP CGI implementation on Windows platforms. PHP, a popular open-source server-side scripting language, uses the Common Gateway Interface (CGI) to process HTTP requests and generate dynamic web content. The vulnerability arises from PHP ignoring the "Best Fit" feature for character conversion on Windows, allowing attackers to construct malicious requests that can bypass the CVE-2012-1823 patch. This enables the execution of arbitrary PHP code without the need for authentication, granting attackers server privileges. Exploitation prerequisites include direct usage of PHP-CGI and affect systems configured in certain language families, such as Simplified Chinese, Traditional Chinese, and Japanese. The vulnerability's impact has been observed in various versions of PHP, particularly those used in the default installations of XAMPP on Windows platforms 23.

• Name: PHP CGI Windows Remote Code Execution Vulnerability
• Identifiers: CVE-2024-4577
• Severity Level: CRITICAL
• CVSS Score: 9.8
• Network Requirements for Exploitation: NETWORK
• Difficulty of Exploitation: LOW
• Required Privileges: NONE
• User Interaction: NONE
• Impacted Vendor: PHP
• Affected Product: PHP
• Scope of Impact: 8.3 <= version < 8.3.8, 8.2 <= version < 8.2.20, 8.1 <= version < 8.1.29
• Classification: Command Injection - Vulnerabilities that allow an attacker to execute arbitrary commands on the host operating system via a vulnerable application.
• Tags:
  • Crucial: A high-impact vulnerability or one that has been known to be exploited, warranting continuous attention.
  • PoC Disclosure: Publicly available proof of concept (PoC) for the vulnerability. (Not verified for accuracy, provided for reference only)
  • RCE: Remote Code Execution - Exploitation of this vulnerability allows remote command execution, potentially leading to system control.
  • KEV: The vulnerability has been known to yield successful exploit activities on the internet.

This vulnerability requires urgent attention and remediation due to its high severity and ease of exploitation. Immediate updates to the latest patched versions of PHP (8.3.8, 8.2.20, and 8.1.29) are strongly recommended to mitigate the risks associated with CVE-2024-4577 35.

Vulnerability Details

The vulnerability identified as CVE-2024-4577 is rooted in PHP's CGI (Common Gateway Interface) mode. Specifically, the vulnerability arises from the CGI engine not properly escaping the soft hyphen character (0xAD). When PHP receives this character, it applies a "best fit" mapping, misinterpreting it as a real hyphen. This misinterpretation allows an attacker to inject additional arguments, leading to the execution of arbitrary code on the vulnerable system. This flaw bypasses existing protections for older vulnerabilities, such as CVE-2012-1823, allowing remote code execution on Windows servers running PHP in CGI mode, particularly in specific language configurations like Traditional Chinese, Simplified Chinese, and Japanese. This issue is exacerbated in default installations using XAMPP for Windows, which exposes the PHP binary in the CGI directory by default 23.

Risks:

• Remote Code Execution (RCE): Exploiting this vulnerability can lead to unauthorized execution of arbitrary code on the targeted PHP server, granting attackers full control over the affected system 23.
• Data Breach: Unauthorized access could lead to the compromise of sensitive data stored on the server, including personal information, intellectual property, and confidential business data 2.
• Ransomware Attacks: The TellYouThePass ransomware group has been actively exploiting this vulnerability to deploy ransomware, encrypt files, and demand ransom payments .
• Service Disruption: Successful exploitation can result in significant service disruptions, as attackers may disable services, delete critical files, or alter system configurations .
• Further Exploitation: The vulnerability can be leveraged to install additional malicious payloads, such as web shells, remote access tools (RATs), or other types of malware, leading to prolonged system compromise .

Affected Manufacturers and Products: The vulnerability affects all versions of PHP on the Windows operating system configured in CGI mode. This includes:

• PHP 8.3 < 8.3.8
• PHP 8.2 < 8.2.20
• PHP 8.1 < 8.1.29
• Older, unsupported versions such as PHP 8, PHP 7, and PHP 5 are also vulnerable 237.

The vulnerability is particularly impactful on XAMPP installations on Windows, as these configurations expose the PHP binary in the CGI directory by default. This makes all versions of XAMPP installations on Windows inherently vulnerable to exploitation 23.

Proof of Concept

The vulnerability CVE-2024-4577 leverages a flaw in the CGI engine of PHP on Windows servers, which fails to properly escape the soft hyphen (0xAD). This failure allows attackers to inject additional arguments, leading to remote command injection. The exploitation steps are as follows:

1. Identify a Target: Locate a Windows server running PHP in CGI mode, specifically configurations using php.exe or php-cgi.exe binaries.
2. Craft Malicious Request: Construct an HTTP request embedding the soft hyphen (0xAD) in the query string.
3. Inject Commands: The soft hyphen is misinterpreted by PHP, allowing the inclusion of additional arguments.
4. Execute Malicious Payload: These arguments can be used to execute arbitrary commands on the server 245.

There are several publicly available Proof of Concept (PoC) codes for CVE-2024-4577, primarily hosted on GitHub. One such PoC executes a simple system command to demonstrate the vulnerability. Specific command lines from the PoC include:

python watchTowr-vs-php_cve-2024-4577.py -c "<?php system('calc');?>" -t http://192.168.253.132/test.sina

The PoC can be accessed from this GitHub repository: watchtowrlabs/CVE-2024-4577 .

Exploitation

CVE-2024-4577 represents a critical vulnerability in PHP, specifically affecting Windows servers running PHP in CGI mode. It enables remote code execution by exploiting a CGI argument injection flaw. The vulnerability stems from the mismanagement of the soft hyphen (0xAD) character, facilitating unauthorized argument injection. Exploitation can occur in all PHP versions, including older and unsupported versions, especially in Traditional Chinese, Simplified Chinese, and Japanese language configurations.

Exploitation timeline:

• 2024-06-13: "June 14, 2024: TellYouThePass Ransomware Leverages PHP..." — Censys published a live dashboard tracking infected hosts, observing around 1,000 compromised systems primarily in China .
• 2024-06-10: "CVE-2024-4577 Detection: A New Easy-to-Exploit PHP Vulnerability..." — Imperva reports on the TellYouThePass ransomware exploiting CVE-2024-4577 .
• 2024-06-08: "CVE-2024-4577: PHP Injection Vulnerability in Windows Server" — The first victim of the TellYouThePass ransomware was reported 9.
• 2024-06-07: "What's Going on With CVE-2024-4577 (Critical RCE in PHP)?" — Proof-of-concept exploit code for CVE-2024-4577 was published 4.
• 2024-06-06: "CVE-2024-4577: Critical vulnerability in PHP - Tarlogic" — PHP releases security updates to address the vulnerability 7.
• 2024-05-07: "CVE-2024-4577 Detection: A New Easy-to-Exploit PHP Vulnerability..." — CVE-2024-4577 vulnerability discovered and reported to the PHP team 5.

Remediation

An official fix for CVE-2024-4577 has been released. The PHP development team has issued updates to address this critical vulnerability. The patched versions include PHP 8.3.8, PHP 8.2.20, and PHP 8.1.29 235.

The primary method of fixing this vulnerability is to update the PHP software to one of the newly patched versions. Administrators should apply these updates urgently to mitigate the risk of exploitation. The fixed versions can be downloaded from the PHP official website. For environments where updating PHP immediately is not feasible, temporary mitigations include:

1. Adding a rewrite rule to block malicious query strings:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^%ad [NC]
RewriteRule .? - [F,L]

2. For XAMPP installations on Windows, commenting out the following line in the httpd-xampp.conf file:

# ScriptAlias /php-cgi/ "C:/xampp/php/"

3. Evaluating and possibly migrating to more secure architectures such as Mod-PHP, FastCGI, or PHP-FPM.

Here are the links to the patched versions of PHP:

These steps should be implemented immediately to secure systems against the vulnerabilities associated with CVE-2024-4577 347.

Intels

Links