Argument Injection in PHP-CGI
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 9.8epss 100%
da publicação à arma0 dias
Publicada no NVD9 de jun.
1ª PoC13 de jan.
metasploit6 de jun.
CISA KEV+3d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simCISA + VulnCheck
140 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2024-07-03
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
PHP Group · PHPPoCs públicas encontradas — 140
exploitdbwww.exploit-db.com/exploits/52331não verificadogithubgithub.com/watchtowrlabs/CVE-2024-4577★ 317githubgithub.com/xcanwin/CVE-2024-4577-PHP-RCE★ 162githubgithub.com/TAM-K592/CVE-2024-4577★ 76githubgithub.com/Night-have-dreams/php-cgi-Injector★ 49githubgithub.com/11whoami99/CVE-2024-4577★ 43githubgithub.com/Chocapikk/CVE-2024-4577★ 35githubgithub.com/ZephrFish/CVE-2024-4577-PHP-RCE★ 33githubgithub.com/gh-ost00/CVE-2024-4577-RCE★ 25githubgithub.com/BTtea/CVE-2024-4577-RCE-PoC★ 25githubgithub.com/huseyinstif/CVE-2024-4577-Nuclei-Template★ 22githubgithub.com/gotr00t0day/CVE-2024-4577★ 13githubgithub.com/K3ysTr0K3R/CVE-2024-4577-EXPLOIT★ 10githubgithub.com/manuelinfosec/CVE-2024-4577★ 9githubgithub.com/l0n3m4n/CVE-2024-4577-RCE★ 7githubgithub.com/0x20c/CVE-2024-4577-nuclei★ 6githubgithub.com/aavamin/cve-2024-4577★ 5githubgithub.com/bibo318/CVE-2024-4577-RCE-ATTACK★ 5githubgithub.com/longhoangth18/CVE-2024-4577★ 5githubgithub.com/CirqueiraDev/MassExploit-CVE-2024-4577★ 5githubgithub.com/Sh0ckFR/CVE-2024-4577★ 4githubgithub.com/ibrahmsql/CVE-2024-4577★ 3githubgithub.com/zomasec/CVE-2024-4577★ 3githubgithub.com/JeninSutradhar/CVE-2024-4577-checker★ 3githubgithub.com/AlperenY-cs/CVE-2024-4577★ 2githubgithub.com/d3ck4/Shodan-CVE-2024-4577★ 2githubgithub.com/byteReaper77/CVE-2024-4577★ 2githubgithub.com/VictorShem/CVE-2024-4577★ 2githubgithub.com/phirojshah/CVE-2024-4577★ 2githubgithub.com/Wh02m1/CVE-2024-4577★ 1githubgithub.com/ggfzx/CVE-2024-4577★ 1githubgithub.com/Sysc4ll3r/CVE-2024-4577★ 1githubgithub.com/taida957789/CVE-2024-4577★ 1githubgithub.com/gl1tch0x1/PHP_8.1.x_Exploit★ 1githubgithub.com/sug4r-wr41th/CVE-2024-4577★ 1githubgithub.com/0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE★ 1githubgithub.com/PhinehasNarh/CVE-2024-4577-LetsDefend-walkthrough★ 1githubgithub.com/ywChen-NTUST/PHP-CGI-RCE-Scanner★ 1githubgithub.com/Junp0/CVE-2024-4577★ 1githubgithub.com/ahmetramazank/CVE-2024-4577★ 0githubgithub.com/dbyMelina/CVE-2024-4577★ 0githubgithub.com/BLACK-ARCHIVERS/CVE-2024-4577★ 0githubgithub.com/bl4cksku11/CVE-2024-4577★ 0githubgithub.com/Entropt/CVE-2024-4577_Analysis★ 0githubgithub.com/jakabakos/CVE-2024-4577-PHP-CGI-argument-injection-RCE★ 0githubgithub.com/olebris/CVE-2024-4577★ 0githubgithub.com/charis3306/CVE-2024-4577★ 0githubgithub.com/gmh5225/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/a-roshbaik/CVE-2024-4577★ 0githubgithub.com/a-roshbaik/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/Jcccccx/CVE-2024-4577★ 0githubgithub.com/bughuntar/CVE-2024-4577★ 0githubgithub.com/AhmedMansour93/Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-★ 0githubgithub.com/tpdlshdmlrkfmcla/php-cgi-cve-2024-4577★ 0githubgithub.com/Didarul342/CVE-2024-4577★ 0githubgithub.com/Gill-Singh-A/CVE-2024-4577-Exploit★ 0githubgithub.com/tntrock/CVE-2024-4577_PowerShell★ 0githubgithub.com/KimJuhyeong95/cve-2024-4577★ 0githubgithub.com/r0otk3r/CVE-2024-4577★ 0githubgithub.com/mananjain61/PHP-CGI-INTERNAL-RCE★ 0githubgithub.com/Skycritch/CVE-2024-4577★ 0githubgithub.com/Ianthinus/CVE-2024-4577★ 0githubgithub.com/InfoSec-DB/PHPCGIScanner★ 0githubgithub.com/a1ex-var1amov/ctf-cve-2024-4577★ 0githubgithub.com/rayngnpc/CVE-2024-4577-rayng★ 0githubgithub.com/Kanak-CypherX/cve-2024-4577-lab★ 0githubgithub.com/razureink/cve-2024-4577-phpcgi_rce_reproduction★ 0githubgithub.com/NKTriS/HTSOC★ 0githubgithub.com/WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP★ 0githubgithub.com/graphite-org/CVE-2024-4577★ 0githubgithub.com/princew88/CVE-2024-4577★ 0githubgithub.com/Ra1n-60W/CVE-2024-4577★ 0githubgithub.com/wilss0n/CVE-2024-4577★ 0githubgithub.com/zjhzjhhh/CVE-2024-4577★ 0vulncheckvulncheck.com/xdb/9e5daca09c8cnão verificadovulncheckvulncheck.com/xdb/0c4b91081cb3não verificadovulncheckvulncheck.com/xdb/d89b163c7ba9não verificadovulncheckvulncheck.com/xdb/552c4106ae73não verificadovulncheckvulncheck.com/xdb/5d63cc33def4não verificadovulncheckvulncheck.com/xdb/7ee6ed2bc73fnão verificadovulncheckvulncheck.com/xdb/912529ac004fnão verificadovulncheckvulncheck.com/xdb/b2eb4bae1e05não verificadovulncheckvulncheck.com/xdb/d3b12b49d03cnão verificadovulncheckvulncheck.com/xdb/7dd0ca311187não verificadovulncheckvulncheck.com/xdb/aa3899b675a4não verificadovulncheckvulncheck.com/xdb/cd32f509d4abnão verificadovulncheckvulncheck.com/xdb/1287f9a713c6não verificadovulncheckvulncheck.com/xdb/acfef3dab7abnão verificadovulncheckvulncheck.com/xdb/cc11323372a3não verificadovulncheckvulncheck.com/xdb/7a69cea7f16dnão verificadovulncheckvulncheck.com/xdb/5d24a3878ae0não verificadovulncheckvulncheck.com/xdb/b2fa764f2781não verificadovulncheckvulncheck.com/xdb/aed5b2a31554não verificadovulncheckvulncheck.com/xdb/c8e637167f42não verificadovulncheckvulncheck.com/xdb/975f3d4508fdnão verificadovulncheckvulncheck.com/xdb/c3ffd6462c70não verificadovulncheckvulncheck.com/xdb/218b19f4d22enão verificadovulncheckvulncheck.com/xdb/ed23c8ab0f6anão verificadovulncheckvulncheck.com/xdb/d06e30d57aafnão verificadovulncheckvulncheck.com/xdb/c4c00e052574não verificadovulncheckvulncheck.com/xdb/081170ce66e7não verificadovulncheckvulncheck.com/xdb/c8c379f83d10não verificadovulncheckvulncheck.com/xdb/64f14f4beecbnão verificadovulncheckvulncheck.com/xdb/cb830f9d202fnão verificadovulncheckvulncheck.com/xdb/d982c4edc474não verificadovulncheckvulncheck.com/xdb/0b2ec7cacbadnão verificadovulncheckvulncheck.com/xdb/ff0f9bccbf68não verificadovulncheckvulncheck.com/xdb/a53150e5fe7bnão verificadovulncheckvulncheck.com/xdb/3e8fa83c20c9não verificadovulncheckvulncheck.com/xdb/20d85040c310não verificadovulncheckvulncheck.com/xdb/825b99bdb560não verificadovulncheckvulncheck.com/xdb/56c6c80d0bc4não verificadovulncheckvulncheck.com/xdb/bd76b0f41ae3não verificadovulncheckvulncheck.com/xdb/e294281b4747não verificadovulncheckvulncheck.com/xdb/64046c52ba42não verificadovulncheckvulncheck.com/xdb/4f6effc389cdnão verificadovulncheckvulncheck.com/xdb/5a6770491004não verificadovulncheckvulncheck.com/xdb/30f842b7c8c9não verificadovulncheckvulncheck.com/xdb/1531cf762de4não verificadovulncheckvulncheck.com/xdb/b914f202bec2não verificadovulncheckvulncheck.com/xdb/024996c990ccnão verificadovulncheckvulncheck.com/xdb/48d0c04eff37não verificadovulncheckvulncheck.com/xdb/94a35549d41enão verificadovulncheckvulncheck.com/xdb/112f55c12274não verificadovulncheckvulncheck.com/xdb/55023f1ef157não verificadovulncheckvulncheck.com/xdb/bd5de034d60fnão verificadovulncheckvulncheck.com/xdb/24731ac505a6não verificadovulncheckvulncheck.com/xdb/fb1b068d71fbnão verificadovulncheckvulncheck.com/xdb/615662ae6addnão verificadovulncheckvulncheck.com/xdb/b4cc52bca529não verificadovulncheckvulncheck.com/xdb/1b1ee9a9f8a3não verificadovulncheckvulncheck.com/xdb/c81a2db7a37cnão verificadovulncheckvulncheck.com/xdb/148c9b11e6f8não verificadovulncheckvulncheck.com/xdb/c24045f1f2b0não verificadovulncheckvulncheck.com/xdb/3e908cfb9d26não verificadovulncheckvulncheck.com/xdb/11c7d322fe03não verificadovulncheckvulncheck.com/xdb/fa348e621ba5não verificadovulncheckvulncheck.com/xdb/d943b0b2089bnão verificadovulncheckvulncheck.com/xdb/eeb081100dd5não verificadovulncheckvulncheck.com/xdb/293eaa222a74não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlhttps://blog.talosintelligence.com/new-persistent-attacks-japan/https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/https://github.com/11whoami99/CVE-2024-4577https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvhttps://github.com/rapid7/metasploit-framework/pull/19247https://github.com/watchtowrlabs/CVE-2024-4577https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://isc.sans.edu/diary/30994https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/