# [CVE-2024-4577] PHP CGI Argument Injection Remote Code Execution
**Severity:** CRITICAL | **CVSS Base Score:** 9.8 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
**EPSS Exploit Probability:** 99.99% (Percentile: 99.98%)
**CISA KEV (In The Wild):** YES (Due: Wed Jul 03 2024 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** TellYouThePass Ransomware
**Exploit Status:** active_wild
**Published:** 2026-10-29 | **Updated:** 2026-10-28

## Executive Summary
Critical argument injection flaw in PHP CGI mode on Windows enabling unauthenticated remote code execution via best-fit character encoding bypass.

## Common Weakness Enumeration (CWE)
- **CWE-78**: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- **CWE-178**: Improper Handling of Case Sensitivity

## Affected Vendors & Products
- **Vendor:** PHP Group | **Product:** PHP
  - **Affected Versions:** PHP 8.3 < 8.3.8, 8.2 < 8.2.20, 8.1 < 8.1.29 (all branches on Windows)
  - **Patched Version:** PHP 8.3.8, 8.2.20, 8.1.29

- **Vendor:** Apache Friends | **Product:** XAMPP
  - **Affected Versions:** All Windows XAMPP installations with default CGI configurations
  - **Patched Version:** Upgrade PHP binary to >= 8.2.20 or disable CGI handling

## Technical Root Cause Analysis (AI Defense Agent)
When PHP runs under Apache on Windows with Japanese, Traditional Chinese, or Simplified Chinese locales, the Windows Best-Fit mapping converts soft hyphens (0xAD) and other Unicode codepoints into ASCII hyphens (0x2D). This circumvents the escape shell argument protections implemented in CVE-2012-1823, allowing arbitrary command line switches to be passed to php-cgi.exe.

## Exploitation Mechanism & Attack Scenario
An adversary sends an HTTP POST request targeting `/test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input` containing raw PHP code in the request body. The web server translates `%AD` to `-`, invoking PHP with arbitrary directive injection, executing the payload directly in the web server process context.

## Enterprise Blast Radius
Immediate web shell deployment, LSASS memory dumping via process injection, AD domain enumeration, and secondary payload deployment including ransomware or cobalt strike beacons.

## Remediation & Mitigation Playbook
1. Immediately upgrade PHP to versions 8.3.8, 8.2.20, or 8.1.29.
2. If patching cannot be performed immediately, add rewrite rules in Apache HTTP Server to block requests containing '%ADd': `RewriteCond %{QUERY_STRING} ^.*(\xad|%ad).* [NC] RewriteRule .* - [F,L]`
3. Discontinue using legacy PHP CGI mode; transition workloads to PHP-FPM or FastCGI with strict directive argument filtering.
4. Restrict outbound Internet connectivity from web server DMZs to prevent C2 beaconing and secondary payload retrieval.

## Detection Guidance & Telemetry
Inspect web server access logs for query parameters containing `%AD` or `\xad` followed by `allow_url_include` or `auto_prepend_file`. Monitor php-cgi.exe spawning cmd.exe, powershell.exe, or certutil.exe.

### Sigma Detection Rule
```yaml
title: PHP CGI Argument Injection CVE-2024-4577
status: critical
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - '%ad'
      - '%AD'
    cs-uri-query|contains|all:
      - 'allow_url_include'
      - 'auto_prepend_file'
  condition: selection
```


## References
- [DEVCORE Advisory: PHP CGI Argument Injection (CVE-2024-4577)](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/) (advisory)
- [CISA KEV Catalog Entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (cisa)
- [PHP Official Release Announcement](https://www.php.net/ChangeLog-8.php#8.3.8) (patch)