2024-058: Vulnerabilities in PHP

2024-058: Vulnerabilities in PHP ↗ source

June 13, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-058/

Summary

On June 6, 2024, a critical vulnerability was identified in certain versions of PHP that could allow the execution of arbitrary code or disclosure of sensitive information on Windows systems using Apache and PHP-CGI [1]. The vulnerability is currently being actively exploited, and several proof of concepts are available [2]. The vulnerability, identified as CVE-2024-4577. with a CVSS score of 9.3 [3], affects certain PHP versions. When using Apache and PHP-CGI on Windows, if the system is configured to use specific code pages, Windows may utilise Best-Fit behaviour to replace characters in the command line given to Win32 API functions. This behaviour can cause the PHP CGI module to misinterpret these characters as PHP options, potentially allowing a malicious user to pass options to the PHP binary being executed. This vulnerability could lead to the exposure of script source code or the execution of arbitrary PHP code on the server.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-4577	9.8 Critical	PHP Group PHP PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This v…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Apache 40 KEV PHP Group 1 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.