{"status":"success","data":{"id":"CVE-2024-4577","slug":"cve-2024-4577-php-cgi-argument-injection","title":"PHP CGI Argument Injection Remote Code Execution","summary":"Critical argument injection flaw in PHP CGI mode on Windows enabling unauthenticated remote code execution via best-fit character encoding bypass.","description":"A vulnerability in PHP when deployed in CGI mode on Windows allows an unauthenticated remote attacker to bypass CVE-2012-1823 protections via the Best-Fit character conversion feature of the Windows operating system. An attacker can pass arbitrary command-line arguments to the PHP binary, such as -d allow_url_include=1 and auto_prepend_file=php://input, resulting in arbitrary PHP code execution on the host.","severity":"CRITICAL","cvss_score":9.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.99987,"epss_percentile":0.99984,"cisa_kev":true,"cisa_date_added":"2024-06-12T00:00:00.000Z","cisa_due_date":"2024-07-03T00:00:00.000Z","ransomware_campaign":"TellYouThePass Ransomware","threat_actors":["TellYouThePass Affiliates","APT-C-36"],"exploit_status":"active_wild","cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"id":"CWE-178","name":"Improper Handling of Case Sensitivity"}],"affected_vendors":["PHP","Apache Friends (XAMPP)","The PHP Group"],"affected_products":[{"cpe":"cpe:2.3:a:php:php:*:*:*:*:*:*:windows:*","vendor":"PHP Group","product":"PHP","fixed_version":"PHP 8.3.8, 8.2.20, 8.1.29","affected_versions":"PHP 8.3 < 8.3.8, 8.2 < 8.2.20, 8.1 < 8.1.29 (all branches on Windows)"},{"cpe":"cpe:2.3:a:apachefriends:xampp:*:*:*:*:*:windows:*","vendor":"Apache Friends","product":"XAMPP","fixed_version":"Upgrade PHP binary to >= 8.2.20 or disable CGI handling","affected_versions":"All Windows XAMPP installations with default CGI configurations"}],"ai_analysis":{"sigma_rule":"title: PHP CGI Argument Injection CVE-2024-4577\nstatus: critical\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - '%ad'\n      - '%AD'\n    cs-uri-query|contains|all:\n      - 'allow_url_include'\n      - 'auto_prepend_file'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A weaponized, zero-interaction remote code execution vulnerability impacting PHP servers running on Windows under CGI or FastCGI with default configurations. Actively exploited in the wild to deliver ransomware.","detection_guidance":"Inspect web server access logs for query parameters containing `%AD` or `\\xad` followed by `allow_url_include` or `auto_prepend_file`. Monitor php-cgi.exe spawning cmd.exe, powershell.exe, or certutil.exe.","mitigation_playbook":["Immediately upgrade PHP to versions 8.3.8, 8.2.20, or 8.1.29.","If patching cannot be performed immediately, add rewrite rules in Apache HTTP Server to block requests containing '%ADd': `RewriteCond %{QUERY_STRING} ^.*(\\xad|%ad).* [NC] RewriteRule .* - [F,L]`","Discontinue using legacy PHP CGI mode; transition workloads to PHP-FPM or FastCGI with strict directive argument filtering.","Restrict outbound Internet connectivity from web server DMZs to prevent C2 beaconing and secondary payload retrieval."],"technical_root_cause":"When PHP runs under Apache on Windows with Japanese, Traditional Chinese, or Simplified Chinese locales, the Windows Best-Fit mapping converts soft hyphens (0xAD) and other Unicode codepoints into ASCII hyphens (0x2D). This circumvents the escape shell argument protections implemented in CVE-2012-1823, allowing arbitrary command line switches to be passed to php-cgi.exe.","exploitation_mechanism":"An adversary sends an HTTP POST request targeting `/test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input` containing raw PHP code in the request body. The web server translates `%AD` to `-`, invoking PHP with arbitrary directive injection, executing the payload directly in the web server process context.","enterprise_blast_radius":"Immediate web shell deployment, LSASS memory dumping via process injection, AD domain enumeration, and secondary payload deployment including ransomware or cobalt strike beacons."},"references":[{"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","type":"advisory","title":"DEVCORE Advisory: PHP CGI Argument Injection (CVE-2024-4577)"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","type":"cisa","title":"CISA KEV Catalog Entry"},{"url":"https://www.php.net/ChangeLog-8.php#8.3.8","type":"patch","title":"PHP Official Release Announcement"}],"published_at":"2026-10-29T18:21:38.382Z","updated_at":"2026-10-28T18:00:00.000Z"}}