{"id":116414,"date":"2024-06-07T12:05:45","date_gmt":"2024-06-07T10:05:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi"},"modified":"2024-06-07T12:05:45","modified_gmt":"2024-06-07T10:05:45","slug":"uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi","title":{"rendered":"A vulnerability in PHP allows for code execution when operating in CGI mode.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A vulnerability has been discovered in PHP (CVE-2024-4577) that allows for code execution on the server or viewing of the PHP script's source code when using PHP in CGI mode on Windows (configurations with mod_php, php-fpm, and FastCGI are not affected by this vulnerability). The issue has been fixed in PHP releases 8.3.8, 8.2.20, and 8.1.29.<\/p>\n

This vulnerability is a specific case of the issue fixed in 2012 (CVE-2012-1823); the previously added protection proved insufficient to block attacks on the Windows platform. The attack method involves substituting command line arguments when launching the PHP interpreter by manipulating the request parameters to the PHP script. <\/p>\n

In the old vulnerability CVE-2012-1823, it was sufficient to specify command-line options instead of request parameters, for example, 'http:\/\/localhost\/index.php?-s' to display the script's source code. The new vulnerability is based on the fact that the Windows platform automatically converts characters, allowing the circumvention of previously added protection by specifying characters present in certain encodings that are replaced with the character '-' (for instance, http:\/\/localhost\/index.php?s). <\/p>\n

The vulnerability has been confirmed in configurations with locales for Traditional Chinese (cp950), Simplified Chinese (cp936), and Japanese (cp932), but its manifestation with other locales cannot be excluded. The issue appears in the default configuration of the XAMPP stack (Apache + MariaDB + PHP + Perl), as well as in any Apache configurations where php-cgi is set as the CGI script handler through the configuration
\n'Action cgi-script \"cgi-bin\/php-cgi.exe\"' or 'Action application\/x-httpd-php-cgi \"php-cgi\/php-cgi.exe\"', or by directly placing the PHP interpreter in \"cgi-bin\" and any other directories where the execution of CGI scripts is allowed via the ScriptAlias directive.<\/p>\n

Additionally, the PHP updates 8.3.8, 8.2.20, and 8.1.29 fixed three more vulnerabilities: <\/p>\n