PHP fixes critical vulnerability impacting all Windows PHP versions
Take action: If you are using PHP on any of your systems, it's time to act. Update the version of PHP or start implementing mitigation rules. Because hackers are already looking for your vulnerable PHP server.
Learn More
PHP has addressed a critical remote code execution (RCE) vulnerability affecting all versions of PHP on Windows since version 5.x.
The flaw, tracked as CVE-2024-4577 (CVSS score 9.8), was discovered by Devcore, and reported to the PHP developers. The vulnerability arises from an oversight in handling character encoding conversions, specifically the 'Best-Fit' feature on Windows when PHP is used in CGI mode. This oversight allows unauthenticated attackers to execute arbitrary code on remote PHP servers through an argument injection attack, circumventing protections put in place for CVE-2012-1823.
The PHP project maintainers released patches on June 6, 2024, for supported versions, addressing this vulnerability in
- PHP 8.3.8,
- PHP 8.2.20,
- PHP 8.1.29.
Due to the widespread deployment of PHP and general resistance of changes many systems may remain vulnerable if not promptly updated.
The CVE-2024-4577 flaw impacts not only PHP installations but also the XAMPP development environment on Windows. Systems running PHP in CGI mode or having PHP executables accessible by the web server are at risk.
Remediation amd mitigation strategies include
- Updating PHP: Users should upgrade to PHP 8.3.8, PHP 8.2.20, or PHP 8.1.29, which incorporate the necessary patches.
- Applying Mitigations: For systems that cannot be immediately upgraded, a mod_rewrite rule can be applied to block attacks:
RewriteEngine On
RewriteCond %{QUERY_STRING} ^%ad [NC]
RewriteRule .? – [F,L]
- Disabling PHP CGI: XAMPP users who do not require the PHP CGI feature should comment out the 'ScriptAlias' directive in the Apache configuration file (httpd-xampp.conf).
- Checking Server Configuration: Administrators can use the phpinfo() function to check the 'Server API' value and determine if PHP-CGI is in use.
- Migrating to Secure Alternatives: Consider moving from CGI to more secure alternatives such as FastCGI, PHP-FPM, or Mod-PHP.
Attackers and researchers have already begun scanning for vulnerable systems, as noted by The Shadowserver Foundation.
Update - The notorious TellYouThePass ransomware gang exploits the remote code execution (RCE) vulnerability in PHP to compromise servers and deploy their malicious payloads. Time to patch NOW.
