Details have emerged about a new critical security flaw impacting PHP that could be exploited to achieve remote code execution under certain circumstances.
The vulnerability, tracked as CVE-2024-4577, is described as a CGI argument injection vulnerability affecting all versions of PHP installed on the Windows operating system.
According to DEVCORE security researcher, the shortcoming allows bypassing protections put in place for another security flaw, CVE-2012-1823. While implementing PHP, the team did not notice the “Fit feature of encoding conversion within the Windows operating system,” security researcher Orange Tsai said.
“This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. Arbitrary code can be executed on remote PHP servers through the argument injection attack.”
Following responsible disclosure on May 7, 2024, a fix for the vulnerability has been made available in PHP versions 8.3.8, 8.2.20, and 8.1.29.
DEVCORE has warned that all XAMPP installations on Windows are vulnerable by default when configured to use the locales for Traditional Chinese, Simplified Chinese, or Japanese. The Taiwanese company is recommending administrators move away from the outdated PHP CGI altogether and opt for a more secure solution such as Mod-PHP, FastCGI, or PHP-FPM.
“This vulnerability is incredibly simple, but that’s also what makes it interesting,” Tsai said. “Who would have thought that a patch, which has been reviewed and proven secure for the past 12 years, could be bypassed due to a minor Windows feature?”
The Shadowserver Foundation, in a post shared on X, said it has already detected exploitation attempts involving the flaw against its honeypot servers within 24 hours of public disclosures
<hr>

Welcome to PHP Dev, a dedicated space for sharing knowledge about PHP and its ecosystem (only PHP directly related).
Help us find good articles and blogposts and provide links. Upvote or downvote, after reading, it's essential

PHP Dev

New critical security flaw in PHP allows remote code execution due to a CGI argument injection vulnerability. Impacting all versions of PHP on Windows. Secure alternatives to PHP CGI recommended.

Critical Security Flaw in PHP: CVE-2024-4577