In PHP is a vulnerability (CVE-2024-4577) that allows for code execution on the server or viewing the source code of PHP scripts when PHP is used in CGI mode on the Windows platform (configurations with mod_php, php-fpm, and FastCGI are not affected by this vulnerability). The issue has been addressed in PHP releases 8.3.8, 8.2.20, and 8.1.29.
The vulnerability is a specific case of the issue corrected in 2012 under CVE-2012-1823, for which the added protection was insufficient to block the attack on the Windows platform. The attack method involves substituting command-line arguments when launching the PHP interpreter through manipulation of request parameters to the PHP script.
Bij de oude kwetsbaarheid CVE-2012-1823 was het voldoende om opdrachtregelopties op te geven in plaats van aanvraagparameters, bijvoorbeeld "http://localhost/index.php?-s" om de broncode van het script weer te geven. De nieuwe kwetsbaarheid is gebaseerd op het feit dat het Windows-platform automatisch tekens omzet, waardoor het mogelijk is om eerder toegevoegde beveiligingsmaatregelen te omzeilen door tekens op te geven die in bepaalde coderingen aanwezig zijn en vervangen worden door het teken "-" (bijvoorbeeld http://localhost/index.php?s).
The vulnerability has been confirmed in configurations with locales for traditional Chinese (cp950), simplified Chinese (cp936), and Japanese (cp932) languages, but it is possible that it manifests with other locales as well. The issue appears in the default configuration of the XAMPP package (Apache + MariaDB + PHP + Perl), as well as in any Apache configurations where php-cgi is set as the handler for CGI scripts via the configuration
'Action cgi-script Ā«/cgi-bin/php-cgi.exeĀ»' or 'Action application/x-httpd-php-cgi Ā«/php-cgi/php-cgi.exeĀ»' or when directly placing the php interpreter in Ā«/cgi-binĀ» and any other directories where the execution of CGI scripts is allowed via the ScriptAlias directive.
Additionally, in the updates PHP 8.3.8, 8.2.20, and 8.1.29, three more vulnerabilities have been addressed:
- CVE-2024-5458 ā the possibility of bypassing the filter
FILTER_VALIDATE_URL, used when calling the function filter_var. - CVE-2024-5585 ā an alternative attack vector on the vulnerability CVE-2024-1874, allowing for bypassing previously added protection and executing command substitutions when calling bat and cmd files through the proc_open function on the Windows platform (vulnerability BatBadBut).
- The openssl_private_decrypt function is vulnerable to the Marvin attack.
Bron: opennet.ru
