Argument Injection in PHP-CGI
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 100%
from disclosure to weapon0 days
Published on NVDJun 9
1st PoCJan 13
metasploitJun 6
CISA KEV+3d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
140 public exploit(s)
Action required by CISAfederal deadline: 2024-07-03
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
PHP Group · PHPpublic PoCs found — 140
exploitdbwww.exploit-db.com/exploits/52331unverifiedgithubgithub.com/watchtowrlabs/CVE-2024-4577★ 317githubgithub.com/xcanwin/CVE-2024-4577-PHP-RCE★ 162githubgithub.com/TAM-K592/CVE-2024-4577★ 76githubgithub.com/Night-have-dreams/php-cgi-Injector★ 49githubgithub.com/11whoami99/CVE-2024-4577★ 43githubgithub.com/Chocapikk/CVE-2024-4577★ 35githubgithub.com/ZephrFish/CVE-2024-4577-PHP-RCE★ 33githubgithub.com/gh-ost00/CVE-2024-4577-RCE★ 25githubgithub.com/BTtea/CVE-2024-4577-RCE-PoC★ 25githubgithub.com/huseyinstif/CVE-2024-4577-Nuclei-Template★ 22githubgithub.com/gotr00t0day/CVE-2024-4577★ 13githubgithub.com/K3ysTr0K3R/CVE-2024-4577-EXPLOIT★ 10githubgithub.com/manuelinfosec/CVE-2024-4577★ 9githubgithub.com/l0n3m4n/CVE-2024-4577-RCE★ 7githubgithub.com/0x20c/CVE-2024-4577-nuclei★ 6githubgithub.com/aavamin/cve-2024-4577★ 5githubgithub.com/bibo318/CVE-2024-4577-RCE-ATTACK★ 5githubgithub.com/longhoangth18/CVE-2024-4577★ 5githubgithub.com/CirqueiraDev/MassExploit-CVE-2024-4577★ 5githubgithub.com/Sh0ckFR/CVE-2024-4577★ 4githubgithub.com/ibrahmsql/CVE-2024-4577★ 3githubgithub.com/zomasec/CVE-2024-4577★ 3githubgithub.com/JeninSutradhar/CVE-2024-4577-checker★ 3githubgithub.com/AlperenY-cs/CVE-2024-4577★ 2githubgithub.com/d3ck4/Shodan-CVE-2024-4577★ 2githubgithub.com/byteReaper77/CVE-2024-4577★ 2githubgithub.com/VictorShem/CVE-2024-4577★ 2githubgithub.com/phirojshah/CVE-2024-4577★ 2githubgithub.com/Wh02m1/CVE-2024-4577★ 1githubgithub.com/ggfzx/CVE-2024-4577★ 1githubgithub.com/Sysc4ll3r/CVE-2024-4577★ 1githubgithub.com/taida957789/CVE-2024-4577★ 1githubgithub.com/gl1tch0x1/PHP_8.1.x_Exploit★ 1githubgithub.com/sug4r-wr41th/CVE-2024-4577★ 1githubgithub.com/0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE★ 1githubgithub.com/PhinehasNarh/CVE-2024-4577-LetsDefend-walkthrough★ 1githubgithub.com/ywChen-NTUST/PHP-CGI-RCE-Scanner★ 1githubgithub.com/Junp0/CVE-2024-4577★ 1githubgithub.com/ahmetramazank/CVE-2024-4577★ 0githubgithub.com/dbyMelina/CVE-2024-4577★ 0githubgithub.com/BLACK-ARCHIVERS/CVE-2024-4577★ 0githubgithub.com/bl4cksku11/CVE-2024-4577★ 0githubgithub.com/Entropt/CVE-2024-4577_Analysis★ 0githubgithub.com/jakabakos/CVE-2024-4577-PHP-CGI-argument-injection-RCE★ 0githubgithub.com/olebris/CVE-2024-4577★ 0githubgithub.com/charis3306/CVE-2024-4577★ 0githubgithub.com/gmh5225/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/a-roshbaik/CVE-2024-4577★ 0githubgithub.com/a-roshbaik/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/Jcccccx/CVE-2024-4577★ 0githubgithub.com/bughuntar/CVE-2024-4577★ 0githubgithub.com/AhmedMansour93/Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-★ 0githubgithub.com/tpdlshdmlrkfmcla/php-cgi-cve-2024-4577★ 0githubgithub.com/Didarul342/CVE-2024-4577★ 0githubgithub.com/Gill-Singh-A/CVE-2024-4577-Exploit★ 0githubgithub.com/tntrock/CVE-2024-4577_PowerShell★ 0githubgithub.com/KimJuhyeong95/cve-2024-4577★ 0githubgithub.com/r0otk3r/CVE-2024-4577★ 0githubgithub.com/mananjain61/PHP-CGI-INTERNAL-RCE★ 0githubgithub.com/Skycritch/CVE-2024-4577★ 0githubgithub.com/Ianthinus/CVE-2024-4577★ 0githubgithub.com/InfoSec-DB/PHPCGIScanner★ 0githubgithub.com/a1ex-var1amov/ctf-cve-2024-4577★ 0githubgithub.com/rayngnpc/CVE-2024-4577-rayng★ 0githubgithub.com/Kanak-CypherX/cve-2024-4577-lab★ 0githubgithub.com/razureink/cve-2024-4577-phpcgi_rce_reproduction★ 0githubgithub.com/NKTriS/HTSOC★ 0githubgithub.com/WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP★ 0githubgithub.com/graphite-org/CVE-2024-4577★ 0githubgithub.com/princew88/CVE-2024-4577★ 0githubgithub.com/Ra1n-60W/CVE-2024-4577★ 0githubgithub.com/wilss0n/CVE-2024-4577★ 0githubgithub.com/zjhzjhhh/CVE-2024-4577★ 0vulncheckvulncheck.com/xdb/9e5daca09c8cunverifiedvulncheckvulncheck.com/xdb/0c4b91081cb3unverifiedvulncheckvulncheck.com/xdb/d89b163c7ba9unverifiedvulncheckvulncheck.com/xdb/552c4106ae73unverifiedvulncheckvulncheck.com/xdb/5d63cc33def4unverifiedvulncheckvulncheck.com/xdb/7ee6ed2bc73funverifiedvulncheckvulncheck.com/xdb/912529ac004funverifiedvulncheckvulncheck.com/xdb/b2eb4bae1e05unverifiedvulncheckvulncheck.com/xdb/d3b12b49d03cunverifiedvulncheckvulncheck.com/xdb/7dd0ca311187unverifiedvulncheckvulncheck.com/xdb/aa3899b675a4unverifiedvulncheckvulncheck.com/xdb/cd32f509d4abunverifiedvulncheckvulncheck.com/xdb/1287f9a713c6unverifiedvulncheckvulncheck.com/xdb/acfef3dab7abunverifiedvulncheckvulncheck.com/xdb/cc11323372a3unverifiedvulncheckvulncheck.com/xdb/7a69cea7f16dunverifiedvulncheckvulncheck.com/xdb/5d24a3878ae0unverifiedvulncheckvulncheck.com/xdb/b2fa764f2781unverifiedvulncheckvulncheck.com/xdb/aed5b2a31554unverifiedvulncheckvulncheck.com/xdb/c8e637167f42unverifiedvulncheckvulncheck.com/xdb/975f3d4508fdunverifiedvulncheckvulncheck.com/xdb/c3ffd6462c70unverifiedvulncheckvulncheck.com/xdb/218b19f4d22eunverifiedvulncheckvulncheck.com/xdb/ed23c8ab0f6aunverifiedvulncheckvulncheck.com/xdb/d06e30d57aafunverifiedvulncheckvulncheck.com/xdb/c4c00e052574unverifiedvulncheckvulncheck.com/xdb/081170ce66e7unverifiedvulncheckvulncheck.com/xdb/c8c379f83d10unverifiedvulncheckvulncheck.com/xdb/64f14f4beecbunverifiedvulncheckvulncheck.com/xdb/cb830f9d202funverifiedvulncheckvulncheck.com/xdb/d982c4edc474unverifiedvulncheckvulncheck.com/xdb/0b2ec7cacbadunverifiedvulncheckvulncheck.com/xdb/ff0f9bccbf68unverifiedvulncheckvulncheck.com/xdb/a53150e5fe7bunverifiedvulncheckvulncheck.com/xdb/3e8fa83c20c9unverifiedvulncheckvulncheck.com/xdb/20d85040c310unverifiedvulncheckvulncheck.com/xdb/825b99bdb560unverifiedvulncheckvulncheck.com/xdb/56c6c80d0bc4unverifiedvulncheckvulncheck.com/xdb/bd76b0f41ae3unverifiedvulncheckvulncheck.com/xdb/e294281b4747unverifiedvulncheckvulncheck.com/xdb/64046c52ba42unverifiedvulncheckvulncheck.com/xdb/4f6effc389cdunverifiedvulncheckvulncheck.com/xdb/5a6770491004unverifiedvulncheckvulncheck.com/xdb/30f842b7c8c9unverifiedvulncheckvulncheck.com/xdb/1531cf762de4unverifiedvulncheckvulncheck.com/xdb/b914f202bec2unverifiedvulncheckvulncheck.com/xdb/024996c990ccunverifiedvulncheckvulncheck.com/xdb/48d0c04eff37unverifiedvulncheckvulncheck.com/xdb/94a35549d41eunverifiedvulncheckvulncheck.com/xdb/112f55c12274unverifiedvulncheckvulncheck.com/xdb/55023f1ef157unverifiedvulncheckvulncheck.com/xdb/bd5de034d60funverifiedvulncheckvulncheck.com/xdb/24731ac505a6unverifiedvulncheckvulncheck.com/xdb/fb1b068d71fbunverifiedvulncheckvulncheck.com/xdb/615662ae6addunverifiedvulncheckvulncheck.com/xdb/b4cc52bca529unverifiedvulncheckvulncheck.com/xdb/1b1ee9a9f8a3unverifiedvulncheckvulncheck.com/xdb/c81a2db7a37cunverifiedvulncheckvulncheck.com/xdb/148c9b11e6f8unverifiedvulncheckvulncheck.com/xdb/c24045f1f2b0unverifiedvulncheckvulncheck.com/xdb/3e908cfb9d26unverifiedvulncheckvulncheck.com/xdb/11c7d322fe03unverifiedvulncheckvulncheck.com/xdb/fa348e621ba5unverifiedvulncheckvulncheck.com/xdb/d943b0b2089bunverifiedvulncheckvulncheck.com/xdb/eeb081100dd5unverifiedvulncheckvulncheck.com/xdb/293eaa222a74unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlhttps://blog.talosintelligence.com/new-persistent-attacks-japan/https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/https://github.com/11whoami99/CVE-2024-4577https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvhttps://github.com/rapid7/metasploit-framework/pull/19247https://github.com/watchtowrlabs/CVE-2024-4577https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://isc.sans.edu/diary/30994https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/