CVE-2024-4577 | Attaxion

CISA Known Exploited Vulnerability (KEV)

Name

PHP-CGI OS Command Injection Vulnerability

Exploit added

June 12, 2024

Action due

July 3, 2024

Action required

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use “Best-Fit” behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

References

Weakness Enumeration

CWE-ID	CWE Name
CWE-78	Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

Known Affected Software Configurations

cpe:2.3:a:php:php:8.1.28:-::::::
cpe:2.3:a:php:php:8.1.23:rc1::::::
cpe:2.3:a:php:php:7.4.33:::::::*
cpe:2.3:a:php:php:8.2.14:rc1::::::
cpe:2.3:a:php:php:8.2.20:-::::::
cpe:2.3:a:php:php:8.3.7:rc1::::::
cpe:2.3:a:php:php:8.2.11:rc1::::::
cpe:2.3:a:php:php:8.1.29:rc1::::::
cpe:2.3:a:php:php:8.3.0:rc6::::::
cpe:2.3:a:php:php:8.3.8:rc1::::::
cpe:2.3:a:php:php:8.2.16:rc1::::::
cpe:2.3:a:php:php:8.3.3:-::::::
cpe:2.3:a:php:php:8.2.16:-::::::
cpe:2.3:a:php:php:8.1.29:-::::::
cpe:2.3:a:php:php:8.3.3:rc1::::::
cpe:2.3:a:php:php:8.1.26:rc1::::::
cpe:2.3:a:php:php:8.1.25:-::::::
cpe:2.3:a:php:php:8.1.23:-::::::
cpe:2.3:a:php:php:8.2.18:rc1::::::
cpe:2.3:a:php:php:8.2.20:rc1::::::
cpe:2.3:a:php:php:8.2.12:-::::::
cpe:2.3:a:php:php:7.4.32:::::::*
cpe:2.3:a:php:php:8.1.26:-::::::
cpe:2.3:a:php:php:8.3.5:-::::::
cpe:2.3:a:php:php:8.3.6:-::::::
cpe:2.3:a:php:php:8.2.17:rc1::::::
cpe:2.3:a:php:php:8.3.0:rc1::::::
cpe:2.3:a:php:php:8.2.19:-::::::
cpe:2.3:a:php:php:8.2.15:-::::::
cpe:2.3:a:php:php:8.2.14:-::::::
cpe:2.3:a:php:php:8.1.28:rc1::::::
cpe:2.3:a:php:php:8.2.13:-::::::
cpe:2.3:a:php:php:8.1.27:rc1::::::
cpe:2.3:a:php:php:8.2.15:rc1::::::
cpe:2.3:a:php:php:7.4.31:::::::*
cpe:2.3:a:php:php:8.1.27:-::::::
cpe:2.3:a:php:php:8.1.24:rc1::::::
cpe:2.3:a:php:php:8.2.12:rc1::::::
cpe:2.3:a:php:php:8.3.2:-::::::
cpe:2.3:a:php:php:8.3.8:-::::::
cpe:2.3:a:php:php:8.2.11:-::::::
cpe:2.3:a:php:php:8.2.18:-::::::
cpe:2.3:a:php:php:8.3.7:-::::::
cpe:2.3:a:php:php:8.3.6:rc1::::::
cpe:2.3:a:php:php:8.2.10:rc1::::::
cpe:2.3:a:php:php:8.3.0:rc5::::::
cpe:2.3:a:php:php:8.3.2:rc1::::::
cpe:2.3:a:php:php:8.3.0:beta3::::::
cpe:2.3:a:php:php:8.2.10:-::::::
cpe:2.3:a:php:php:8.2.19:rc1::::::
cpe:2.3:a:php:php:8.3.4:rc1::::::
cpe:2.3:a:php:php:8.3.5:rc1::::::
cpe:2.3:a:php:php:8.3.4:-::::::
cpe:2.3:a:php:php:8.3.1:rc1::::::
cpe:2.3:a:php:php:8.3.0:rc3::::::
cpe:2.3:a:php:php:8.1.25:rc1::::::
cpe:2.3:a:php:php:8.2.17:-::::::
cpe:2.3:a:php:php:8.3.0:rc2::::::
cpe:2.3:a:php:php:8.2.13:rc1::::::
cpe:2.3:a:php:php:8.3.1:-::::::
cpe:2.3:a:php:php:8.1.24:-::::::
cpe:2.3:a:php:php:8.3.0:rc4::::::
cpe:2.3:a:php:php:5.3.0:-::::::
cpe:2.3:o:fedoraproject:fedora:40:::::::*
cpe:2.3:o:fedoraproject:fedora:39:::::::*
cpe:2.3:a:php:php:8.0.30:::::::*
cpe:2.3:a:php:php:8.2.8:rc1::::::
cpe:2.3:a:php:php:8.2.4:rc1::::::
cpe:2.3:a:php:php:8.2.9:rc1::::::
cpe:2.3:a:php:php:8.2.5:rc1::::::
cpe:2.3:a:php:php:8.2.6:rc1::::::
cpe:2.3:a:php:php:8.2.7:rc1::::::
cpe:2.3:a:php:php:8.3.0:alpha2::::::
cpe:2.3:a:php:php:8.3.0:alpha3::::::
cpe:2.3:a:php:php:8.3.0:beta2::::::
cpe:2.3:a:php:php:8.3.0:alpha1::::::
cpe:2.3:a:php:php:8.3.0:beta1::::::
cpe:2.3:a:php:php:8.1.22:rc1::::::
cpe:2.3:a:php:php:8.1.21:rc1::::::
cpe:2.3:a:php:php:8.1.19:rc1::::::
cpe:2.3:a:php:php:8.1.18:rc1::::::
cpe:2.3:a:php:php:8.1.17:rc1::::::
cpe:2.3:a:php:php:8.1.20:rc1::::::
cpe:2.3:a:php:php:8.2.9:-::::::
cpe:2.3:a:php:php:8.2.8:-::::::
cpe:2.3:a:php:php:8.2.6:-::::::
cpe:2.3:a:php:php:8.2.5:-::::::
cpe:2.3:a:php:php:8.2.4:-::::::
cpe:2.3:a:php:php:8.2.7:-::::::
cpe:2.3:a:php:php:8.1.21:-::::::
cpe:2.3:a:php:php:8.0.29:::::::*
cpe:2.3:a:php:php:8.1.19:-::::::
cpe:2.3:a:php:php:8.1.20:-::::::
cpe:2.3:a:php:php:8.1.18:-::::::
cpe:2.3:a:php:php:8.1.17:-::::::
cpe:2.3:a:php:php:8.2.2:rc1::::::
cpe:2.3:a:php:php:8.2.1:rc1::::::
cpe:2.3:a:php:php:8.2.0:rc3::::::
cpe:2.3:a:php:php:8.2.0:rc2::::::
cpe:2.3:a:php:php:8.2.0:rc7::::::

Details

Source:
NVD

Published:
June 9, 2024

Updated:
August 14, 2024

Risk information

CVSS v3

Base score:
9.8

Severity:

CRITICAL

Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

Not defined