A vulnerability has been discovered in PHP (CVE-2024-4577) that allows for code execution on the server or viewing of the PHP script's source code when using PHP in CGI mode on Windows (configurations with mod_php, php-fpm, and FastCGI are not affected by this vulnerability). The issue has been fixed in PHP releases 8.3.8, 8.2.20, and 8.1.29.
This vulnerability is a specific case of the issue fixed in 2012 (CVE-2012-1823); the previously added protection proved insufficient to block attacks on the Windows platform. The attack method involves substituting command line arguments when launching the PHP interpreter by manipulating the request parameters to the PHP script.
In the old vulnerability CVE-2012-1823, it was sufficient to specify command line options instead of request parameters, for example, "http://localhost/index.php?-s" to display the script's source code. The new vulnerability is based on the fact that the Windows platform performs automatic character conversion, allowing the inclusion of characters present in certain encodings which are replaced with the character "-" (for example, http://localhost/index.php?s) to bypass previously added protections.
The vulnerability has been confirmed in configurations with locales for Traditional Chinese (cp950), Simplified Chinese (cp936), and Japanese (cp932), but its manifestation with other locales cannot be excluded. The issue appears in the default configuration of the XAMPP stack (Apache + MariaDB + PHP + Perl), as well as in any Apache configurations where php-cgi is set as the CGI script handler through the configuration
‘Action cgi-script "/cgi-bin/php-cgi.exe"‘ or ‘Action application/x-httpd-php-cgi "/php-cgi/php-cgi.exe"‘, or by directly placing the php interpreter in "/cgi-bin" and any other directories where executing CGI scripts is allowed via the ScriptAlias directive.
Additionally, the PHP updates 8.3.8, 8.2.20, and 8.1.29 fixed three more vulnerabilities:
- CVE-2024-5458 — the ability to bypass the filter
FILTER_VALIDATE_URL used when calling the filter_var function. - CVE-2024-5585 — an alternate attack vector for vulnerability CVE-2024-1874, allowing bypassing the previously added protection and substituting commands when invoking bat and cmd files through the proc_open function on the Windows platform (vulnerability BatBadBut).
- The openssl_private_decrypt function is vulnerable to the Marvin attack.
Source: opennet.ru
