OS Command Injection in PHP - CVE-2024-4577

Vulnerability identifier: #VU91106

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4577

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in PHP-CGI implementation. A remote attacker can send specially crafted HTTP request to the application and execute arbitrary OS commands on the system.

Note, the vulnerability exists due to incomplete fix for #VU4201 (CVE-2012-1823).

PHP
Gentoo Linux
Slackware Linux
openEuler
Anolis OS
Fedora
Oracle Solaris
EasyApache
Oracle SD-WAN Aware
php-pdo
php-gd
php-gmp
php-help
php-intl
php-ldap
php-mbstring
php-mysqlnd
php-odbc
php-opcache
php-ffi
php-pgsql
php-process
php-snmp
php-soap
php-sodium
php-tidy
php-fpm
php-enchant
php-embedded
php-devel
php-debugsource
php-debuginfo
php-dbg
php-dba
php-common
php-cli
php-bcmath
php
php-xml
php81
php-zip

Install updates from vendor's website.

PHP - addressed in versions 8.1.29, 8.2.20, 8.3.8
EasyApache - addressed in versions 4 2024-6-10, 4 2024-10-2
php-pdo - update to 8.0.30-6
php-gd - update to 8.0.30-6
php-gmp - update to 8.0.30-6
php-help - update to 8.0.30-6
php-intl - update to 8.0.30-6
php-ldap - update to 8.0.30-6
php-mbstring - update to 8.0.30-6
php-mysqlnd - update to 8.0.30-6
php-odbc - update to 8.0.30-6
php-opcache - update to 8.0.30-6
php-ffi - update to 8.0.30-6
php-pgsql - update to 8.0.30-6
php-process - update to 8.0.30-6
php-snmp - update to 8.0.30-6
php-soap - update to 8.0.30-6
php-sodium - update to 8.0.30-6
php-tidy - update to 8.0.30-6
php-fpm - update to 8.0.30-6
php-enchant - update to 8.0.30-6
php-embedded - update to 8.0.30-6
php-devel - update to 8.0.30-6
php-debugsource - update to 8.0.30-6
php-debuginfo - update to 8.0.30-6
php-dbg - update to 8.0.30-6
php-dba - update to 8.0.30-6
php-common - update to 8.0.30-6
php-cli - update to 8.0.30-6
php-bcmath - update to 8.0.30-6
php - update to 8.0.30-6
php-xml - update to 8.0.30-6
php81 - addressed in versions 8.1.29, 8.1.30
php - addressed in versions 8.2.20-1.fc39, 8.2.24-1.fc39, 8.3.8-1.fc40, 8.3.12-1.fc40
php-soap - update to 8.2.24-1
php-sodium - update to 8.2.24-1
php-xml - update to 8.2.24-1
php-zip - update to 8.2.24-1
php-snmp - update to 8.2.24-1
php-process - update to 8.2.24-1
php-pgsql - update to 8.2.24-1
php-pdo - update to 8.2.24-1
php-opcache - update to 8.2.24-1
php-odbc - update to 8.2.24-1
php-mysqlnd - update to 8.2.24-1
php-mbstring - update to 8.2.24-1
php-ldap - update to 8.2.24-1
php-intl - update to 8.2.24-1
php-gmp - update to 8.2.24-1
php-gd - update to 8.2.24-1
php-fpm - update to 8.2.24-1
php-ffi - update to 8.2.24-1
php-enchant - update to 8.2.24-1
php-embedded - update to 8.2.24-1
php-devel - update to 8.2.24-1
php-dbg - update to 8.2.24-1
php-dba - update to 8.2.24-1
php-common - update to 8.2.24-1
php-cli - update to 8.2.24-1
php-bcmath - update to 8.2.24-1
php - update to 8.2.24-1
Oracle Solaris - addressed in versions 11.4 SRU 71, 11.4 SRU 77

• Exploit #11225 - php-cgi-Injector (March 18, 2025)
• Exploit #10913 - CVE-2024-4577-RCE (November 29, 2024)
• Exploit #10871 - CVE-2024-4577-RCE-PoC (November 15, 2024)
• Exploit #10777 - CVE-2024-4577 (October 30, 2024)
• Exploit #10680 - PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows) (October 25, 2024)
• Exploit #10612 - CVE-2024-4577 (October 17, 2024)
• Exploit #10435 - CVE-2024-4577 (CVE-2024-4577 Exploits) (August 23, 2024)
• Exploit #10432 - CVE-2024-4577-RCE (August 23, 2024)
• Exploit #10279 - CVE-2024-4577 (August 2, 2024)
• Exploit #10203 - CVE-2024-4577-RCE-ATTACK (July 12, 2024)
• Exploit #10184 - CVE-2024-4577 (July 5, 2024)
• Exploit #10163 - CVE-2024-4577 (CVE-2024-4577 Exploits) (July 5, 2024)
• Exploit #10097 - CVE-2024-4577 (June 21, 2024)
• Exploit #10091 - CVE-2024-4577-PHP-CGI-argument-injection-RCE (June 21, 2024)
• Exploit #10004 - PHP CGI Argument Injection Remote Code Execution (June 17, 2024)
• Exploit #9974 - CVE-2024-4577 (June 14, 2024)
• Exploit #9945 - CVE-2024-4577 (June 7, 2024)
• Exploit #9943 - CVE-2024-4577 (June 7, 2024)

• https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv

• Multiple vulnerabilities in PHP
• Fedora 39 update for php
• Fedora 40 update for php
• Slackware Linux update for php
• Oracle Solaris update for thrid-party components
• Gentoo update for PHP
• Fedora 40 update for php
• Fedora 39 update for php
• openEuler update for php
• OS Command Injection in Oracle SD-WAN Aware
• cPanel EasyApache update for PHP
• Multiple vulnerabilities in cPanel EasyApache
• Slackware Linux update for php81
• Oracle Solaris update for third-party components
• Anolis OS update for php