CVE-2024-4577

This vulnerability is like a “character translation trick” where an attacker uses special characters to confuse how Windows hands text to PHP. If your server is set up in a particular way, PHP-CGI can treat those tricks as instructions, letting the attacker run code or see files they shouldn’t. Because it needs no login, it’s the kind of issue that attackers can target automatically.

This matters if you run PHP on Windows using Apache with the PHP-CGI setup, and your server is configured with specific non-UTF-8 locale/code page behavior. It is not about a user clicking a link—attackers can send requests directly over the network.

Reachability gate: treat it as a risk only if your Windows server is actually running Apache + PHP-CGI with the affected code page/locale behavior (no authentication is needed to attempt the attack).

This is RED because confirmed real-world exploitation is reflected in CISA KEV and it has been used in ransomware campaigns. Attackers are actively targeting vulnerable exposed servers, and the attack does not require a login or user interaction.

1. Confirm exposure (quick checklist)

   • Determine whether you are running Apache on Windows with PHP-CGI (not only PHP running under a different handler like a separate application process).
   • Check the active PHP version.
   • Check whether the Windows locale/code page settings are configured in a way that uses non-UTF-8 code pages (the issue depends on those specific character mapping behaviors).

2. Determine if your PHP version is vulnerable

   • Vulnerable if using any of these ranges:
     • PHP 8.1: before 8.1.29
     • PHP 8.2: before 8.2.20
     • PHP 8.3: before 8.3.8

3. Patch (recommended path)

   • Upgrade to a fixed version:
     • 8.1.29 or newer in the 8.1 line
     • 8.2.20 or newer in the 8.2 line
     • 8.3.8 or newer in the 8.3 line
   • Plan for a short maintenance window if your server is load-balanced or has multiple nodes—patch all nodes serving web traffic.

4. CISA timing

   • CISA KEV due date: 2024-07-03.
   • Since the fixed versions are available, prioritize completing the upgrade immediately.

5. If patching is delayed (temporary mitigation)

   • Discontinue use of PHP-CGI on Apache for the affected Windows configuration and follow vendor mitigation guidance for the alternative supported PHP hosting model.

6. What to monitor after upgrading

   • Web server logs for suspicious requests targeting PHP endpoints soon after patching (look for unusual requests containing non-standard/specially crafted characters).
   • Confirm the new PHP version is actually running (avoid “upgraded files but old service still running” situations).

7. Validate results

   • Re-run the exposure checklist and confirm your configuration is no longer within the vulnerable PHP version ranges and that PHP-CGI on the Windows/Apache setup is no longer used if mitigation required an alternative.

Severity and verdict: Marked critical (CVSS 9.8) and treated as RED due to confirmed exploitation (CISA KEV listing) with ransomware usage.

Mechanism: This is an argument injection issue (CWE-78) in the Windows build behavior of PHP-CGI under Apache when the system uses certain non-UTF-8 code pages. Windows can apply “Best-Fit” character mapping when converting text passed to Win32 APIs. Crafted requests can take advantage of that conversion so PHP-CGI misinterprets characters as PHP options, which can lead to unauthorized code execution and/or disclosure of sensitive server scripts.

Attack requirements: Network-reachable, no authentication and no user interaction. Preconditions include running on Windows with Apache + PHP-CGI and the specific locale/code page behavior.

Exploitation status: Confirmed real-world exploitation is reflected by CISA KEV; CISA required action to apply mitigations/discontinue if not available.

Patch/fix availability: Fixed PHP versions are provided for multiple branches: 8.1.29, 8.2.20, 8.3.8.