Overview
PHP is a widely used scripting language used mostly for web development. It lets you create dynamic and interactive web applications by embedding it in HTML. It is widely used for tasks like handling forms, session management, and interacting with databases, making it a key component of many content management systems like Wordpress and Drupal.
A command injection vulnerability (CVE-2024-4577) has been identified in PHP that comes from the misinterpretation of characters in certain Windows code pages. This flaw allows attackers to inject arbitrary command-line inputs, which are then processed by PHP. As a result, the attacker can execute unauthorized system commands.
Per OWASP: Command Injection is an attack where arbitrary commands are executed on a host system through a vulnerable application. This occurs when user input, such as data from forms or headers, is passed unsafely to a system shell. The attack exploits insufficient input validation, allowing the attacker to execute commands with the application’s privileges. Command injection leverages the default functionality of the application to run system commands.
This issue affects multiple versions of PHP.
Details
Module Info
- Product: PHP
- Affected packages: PHP-CGI
- Affected versions: >=8.1.0 <8.1.29, >=8.2.0 <8.2.20, >=8.3.0 <8.3.8
- GitHub repository: https://github.com/php/php-src
- Published packages: https://www.php.net
- Package manager: N/A
- Fixed in: ZendPHP through HeroDevs v7.2.34.20, v7.3.33.12, v7.4.33.7, v8.0.30.3, v8.1.30, v8.2.24, v8.3.12
Vulnerability Info
This Critical-severtity vulnerability comes from the “Best-Fit” behavior in certain Windows code pages, which misinterprets special characters. This misinterpretation allows attackers to inject malicious command-line inputs, which are processed by the PHP-CGI. As a result, the attacker can execute arbitrary PHP code, potentially leading to unauthorized access or exposure of sensitive information.
Credits
- Orange Tsai (finder)
Mitigation
Users of the affected components should apply one of the following mitigations:
- Migrate affected applications to the latest PHP versions.
- Leverage a commercial support partner like ZendPHP through HeroDevs for post-EOL security support.
