9.8Kritisch KEV In Ransomware genutzt

CVE-2024-4577Argument Injection in PHP-CGI

PHP Group PHP; php_group php Veröffentlicht: 2024-06-09 22:42 (vor 2 Jahren)

Bekannt ausgenutzt — PHP-CGI OS Command Injection Vulnerability

CISA hat am 12.06.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.07.2024.

Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#; https://nvd.nist.gov/vuln/detail/CVE-2024-4577

Beschreibung

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Schwachstellentyp (CWE): CWE-78

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
fedoraproject	fedora	39
PHP Group	PHP	8.1.* – < 8.1.29, 8.2.* – < 8.2.20, 8.3.* – < 8.3.8

Referenzen und Patches

https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv ExploitThird Party Advisory
https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html Third Party Advisory
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ ExploitThird Party Advisory
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-… ExploitPress/Media CoverageThird Party Advisory
https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/ Third Party Advisory
https://github.com/11whoami99/CVE-2024-4577 Exploit
https://github.com/xcanwin/CVE-2024-4577-PHP-RCE ExploitThird Party Advisory
https://github.com/rapid7/metasploit-framework/pull/19247 ExploitIssue TrackingPatch
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/ ExploitThird Party Advisory
https://github.com/watchtowrlabs/CVE-2024-4577 ExploitThird Party Advisory
https://www.php.net/ChangeLog-8.php#8.1.29 Release Notes
https://www.php.net/ChangeLog-8.php#8.2.20 Release Notes
https://www.php.net/ChangeLog-8.php#8.3.8 Release Notes
https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately Third Party Advisory
https://isc.sans.edu/diary/30994 ExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3R… Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRT… Mailing List
https://security.netapp.com/advisory/ntap-20240621-0008/ Third Party Advisory
https://blog.talosintelligence.com/new-persistent-attacks-japan/ ExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577 ExploitThird Party Advisory
https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577 ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577 US Government Resource

CPE-Treffer (NVD) (5)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.1.0 < 8.1.29
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.20
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.8
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

CVSS-Score

9.8Kritisch

Quelle: php · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (3)

cna	CVSS 3.1	9.8Kritisch
security@php.net	CVSS 3.1	9.8Kritisch
nvd	CVSS 3.1	9.8Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

99.99%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2024-05-06
Veröffentlicht2024-06-09 22:42
Bei IP-DB eingegangen2026-10-24 23:25
In KEV aufgenommen2024-06-12
Zuletzt aktualisiert2026-06-17 11:02

Vergeben von (CNA): php
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — PHP

9.2Kritisch

CVE-2026-109619 KEV vor 12 Tagen

RCE via stale global state

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS

9.2Kritisch

CVE-2026-109618 KEV vor 12 Tagen

RCE via OOM corruption

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS

5.9Mittel

CVE-2026-92842 vor 1 Monat

OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

PHP Group PHP

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup…

6.5Mittel

CVE-2026-91768 vor 1 Monat

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

PHP Group PHP

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with…

4.3Mittel

CVE-2026-91769 vor 1 Monat

TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP Group PHP

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certifi…

6.5Mittel

CVE-2026-91767 vor 1 Monat

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

PHP Group PHP

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious ser…