Critical Vulnerability in PHP (CVE-2024-4577)

Advisory 7, Oct 2024

CVSS Score: Base 9.9 Critical

BACKGROUND

A critical vulnerability in PHP, identified as CVE-2024-4577 has recently been published. This vulnerability could lead to remote command injection.

This vulnerability allows attackers to remotely execute malicious commands on Windows servers running on PHP system. It can be exploited through the PHP-CGI script engine, even when PHP is not configured to run in CGI mode. The PHP-CGI module is integrated into IIS web servers and XAMPP servers, both of which are commonly used for hosting web applications.

This exploit is particularly dangerous due to the widespread use of PHP and XAMPP, the ease of exploitation, and the fact that it involves remote code execution (RCE). Additionally, a proof-of-concept (PoC) for a malicious payload is already available.

IMPACT

May lead to remote command injection.
It could potentially result in complete system compromise.

AFFECTED SYSTEMS

All versions of PHP for Windows are vulnerable, including:

Supported versions (PHP 8.3, 8.2, 8.1)
End-of-life\older versions, which are no longer supported (PHP 8.0, 7.x, 5.x)
XAMPP installations on Windows are particularly susceptible due to its default CGI mode.

RECOMMENDATIONS

Update the affected versions to the fixed or latest versions released by PHP.
Ensure that input parameters are properly sanitized and validated.
Apply secure configuration settings to restrict CGI parameter processing.
For systems that cannot be immediately upgraded and for users of EoL versions, it is recommended to apply a mod_rewrite rule to block attacks, such as the following:

> RewriteEngine On
>RewriteCond %{QUERY_STRING} ^%ad [NC]
>RewriteRule .? – [F,L]

If you use XAMPP and do not need the PHP CGI feature, locate the 'ScriptAlias' directive in the Apache configuration file (typically at 'C:/xampp/apache/conf/extra/httpd-xampp.conf') and comment it out.
System administrators can determine if they use PHP-CGI using the phpinfo() function by checking the 'Server API' value in the output.
It is also suggested that system administrators consider migrating from CGI to a more secure alternative, such as FastCGI, PHP-FPM, and Mod-PHP.