InfraFenceInfraFence

Live Security Operations

Get Started

CVE-2024-4577: PHP-CGI argument injection, check and fix

Last updated:

PHP-CGI on Windows, with some code pages (Japanese, Chinese and others), converts a soft hyphen (%AD) in the command line into a dash. Through Apache, the query string reaches PHP-CGI on the command line, so a URL such as /?%ADd+allow_url_include%3d1 becomes a PHP option and leads to code execution.

The flaw depends on a Windows character conversion: PHP on Linux is not affected. Scanners send the same requests to every server, Linux included, which is why you see them in your logs.

At a glance

CVE
CVE-2024-4577
Software
PHP (PHP-CGI on Windows)
Affected versions
8.3 before 8.3.8, 8.2 before 8.2.20, 8.1 before 8.1.29 and older, on Windows
Fixed in
8.1.29, 8.2.20, 8.3.8
CVSS score
9.8 Critical (NVD, CVSS 3.1) · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known Exploited Vulnerabilities
Yes, added on June 12, 2024
Published by NVD
June 9, 2024
InfraFence virtual patch
vp-cve-2024-4577 (ModSecurity id 9920003)

What is affected

PHP 8.3 before 8.3.8, 8.2 before 8.2.20, 8.1 before 8.1.29 and older versions, on Windows, when PHP runs as CGI (Apache's Action to php-cgi.exe, or the PHP binary reachable from a CGI folder). XAMPP for Windows exposed PHP-CGI by default. PHP as an Apache module, as FastCGI or PHP-FPM is not affected.

Check whether a server is vulnerable

On Linux there is nothing to fix for this CVE; keep PHP on a supported, updated release for the others. You can still see who is trying:

Apache access logs
sudo grep -rhiE '\?(%AD|[^ ]*(\+|%20)%AD)[a-z]' --include='*access*' --exclude='*.gz' /var/log/apache2 /var/log/httpd 2>/dev/null | tail -20

On a Windows server, check the version of PHP and whether Apache runs it as CGI:

Windows command prompt
php -v

Fix it (Windows)

  1. Upgrade PHP to 8.3.8, 8.2.20 or 8.1.29 or later. Versions out of support got no fix: move to a supported one.
  2. Better still, stop running PHP as CGI: use it as an Apache module, FastCGI or PHP-FPM.
  3. On XAMPP, if you do not need PHP-CGI, comment out the ScriptAlias /php-cgi/ line in apache/conf/extra/httpd-xampp.conf and restart Apache.

Until you can upgrade, the researchers who found the flaw published this temporary Apache rule for the affected locales:

Apache configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} ^%ad [NC]
RewriteRule .? - [F,L]

How InfraFence blocks it

The virtual patch for CVE-2024-4577 is a ModSecurity rule on the query string: it blocks a soft hyphen (%AD or the raw byte) followed by a letter at the start of the query string or after a + or an encoded space, the way the attack passes an option.

Note: InfraFence's agent runs on Linux, where PHP is not vulnerable to this CVE. On a Linux server the patch blocks the attempts and reports them, so you see the scans; it does not fix anything that was broken.

How the patch is applied

  1. The agent notes which SSH ports and sites answer.
  2. It writes the rule (ModSecurity id 9920003) between its own markers in its ModSecurity file, runs apachectl configtest and reloads Apache gracefully. A failed test puts the previous file back.
  3. It checks that SSH and the sites still answer, and removes the patch if they do not.
  4. It checks that ModSecurity really blocks with the rule, with a harmless local probe request. A ModSecurity in DetectionOnly only logs: the patch is then removed and reported as ineffective, never as applied.

Every request the patch blocks is reported with CVE-2024-4577 (agent 1.0.37 or later): you see the attempts on the server's activity and on the Exploitation page of the dashboard, so you know the vulnerability is being tried against you.

Warning: A virtual patch blocks the known form of the attack on the requests that go through Apache on that server. It is not a substitute for the update: install the fixed version, then remove the patch from Activity with Undo if you no longer need it.

Virtual patches need Apache with ModSecurity, the setting Allow web server configuration changes, and no hosting panel or configuration manager in charge of the web server; they are part of the Pro plan and AutoMode. A person applies them from the AI analysis, or AutoMode does. See Virtual patches.

Sources

The facts on this page come from these sources; check them for changes.

Try it free on 1 server

Starter is free for one server, with full protection and automatic blocking. No credit card.

Install the agent as root, with your token in place of <TOKEN>:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>

The token is created in the dashboard, in Servers › Add server.

Create a free accountRead the docs