{"id":116414,"date":"2024-06-07T12:05:45","date_gmt":"2024-06-07T10:05:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi"},"modified":"2024-06-07T12:05:45","modified_gmt":"2024-06-07T10:05:45","slug":"uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-php-pozvolyayushhaya-vypolnit-kod-pri-rabote-v-rezhime-cgi","title":{"rendered":"Kw vulnerability in PHP, waardoor code kan worden uitgevoerd in CGI-modus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In PHP is a vulnerability (CVE-2024-4577) that allows for code execution on the server or viewing the source code of PHP scripts when PHP is used in CGI mode on the Windows platform (configurations with mod_php, php-fpm, and FastCGI are not affected by this vulnerability). The issue has been addressed in PHP releases 8.3.8, 8.2.20, and 8.1.29.<\/p>\n

The vulnerability is a specific case of the issue corrected in 2012 under CVE-2012-1823, for which the added protection was insufficient to block the attack on the Windows platform. The attack method involves substituting command-line arguments when launching the PHP interpreter through manipulation of request parameters to the PHP script. <\/p>\n

In de oude kwetsbaarheid CVE-2012-1823 was het voldoende om opties voor de opdrachtregel op te geven in plaats van de aanvraagparameters, bijvoorbeeld, http:\/\/localhost\/index.php?-s om de broncode van het script weer te geven. De nieuwe kwetsbaarheid is gebaseerd op het feit dat het Windows-platform automatische tekenconversie biedt, waardoor het mogelijk is om symbolen op te geven die aanwezig zijn in bepaalde coderingen en vervangen worden door het teken \u2018-\u2019 (bijvoorbeeld, http:\/\/localhost\/index.php?s). <\/p>\n

The vulnerability has been confirmed in configurations with locales for traditional Chinese (cp950), simplified Chinese (cp936), and Japanese (cp932) languages, but it is possible that it manifests with other locales as well. The issue appears in the default configuration of the XAMPP package (Apache + MariaDB + PHP + Perl), as well as in any Apache configurations where php-cgi is set as the handler for CGI scripts via the configuration
\n'Action cgi-script '\/cgi-bin\/php-cgi.exe' of 'Action application\/x-httpd-php-cgi '\/php-cgi\/php-cgi.exe', of bij directe plaatsing van de php-interpreter in '\/cgi-bin' en andere mappen waarin de uitvoering van CGI-scripts is toegestaan via de scriptaliasdirective.<\/p>\n

Additionally, in the updates PHP 8.3.8, 8.2.20, and 8.1.29, three more vulnerabilities have been addressed: <\/p>\n