Vulnerabilities Catalog/CVE-2024-4577
CVE-2024-4577CRITICAL · CVSS 9.8 In The Wild (CISA KEV)
Published: 2026-10-29

PHP CGI Argument Injection Remote Code Execution

Critical argument injection flaw in PHP CGI mode on Windows enabling unauthenticated remote code execution via best-fit character encoding bypass.

EPSS Exploit Probability99.99%
100.0th percentile
Exploit Maturityactive wild
Active Weaponization
Primary VendorsPHP, Apache Friends (XAMPP), The PHP Group
2 product(s) impacted
Ransomware CampaignTellYouThePass Ransomware
Threat intel association

CVSS v3.1 Vector Breakdown

Comprehensive attack metric decomposition according to FIRST specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV)NETWORKRemotely exploitable over network
Attack Complexity (AC)LOWNo specialized access needed
Privileges Required (PR)NONEUnauthenticated exploitation
User Interaction (UI)NONEZero-click / autonomous
Scope (S)UNCHANGEDSecurity authority boundary
Confidentiality (C)HIGHTotal information disclosure
Integrity (I)HIGHTotal compromise of system state
Availability (A)HIGHComplete resource denial

TechOverwatch AI Security Sentinel Analysis

Model: Gemini 2.0 Flash Security Sentinel · Generated: 2026-10-28

Executive Defense Summary

A weaponized, zero-interaction remote code execution vulnerability impacting PHP servers running on Windows under CGI or FastCGI with default configurations. Actively exploited in the wild to deliver ransomware.

Technical Root Cause Architecture

When PHP runs under Apache on Windows with Japanese, Traditional Chinese, or Simplified Chinese locales, the Windows Best-Fit mapping converts soft hyphens (0xAD) and other Unicode codepoints into ASCII hyphens (0x2D). This circumvents the escape shell argument protections implemented in CVE-2012-1823, allowing arbitrary command line switches to be passed to php-cgi.exe.

Exploitation Scenario & Attack Chain

An adversary sends an HTTP POST request targeting `/test.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input` containing raw PHP code in the request body. The web server translates `%AD` to `-`, invoking PHP with arbitrary directive injection, executing the payload directly in the web server process context.

Enterprise Blast Radius & Lateral Risk

Immediate web shell deployment, LSASS memory dumping via process injection, AD domain enumeration, and secondary payload deployment including ransomware or cobalt strike beacons.

Remediation & Defense Playbook

Immediate actionable steps for DevOps, SecOps, and Security Architects

1Immediately upgrade PHP to versions 8.3.8, 8.2.20, or 8.1.29.
2If patching cannot be performed immediately, add rewrite rules in Apache HTTP Server to block requests containing '%ADd': `RewriteCond %{QUERY_STRING} ^.*(\xad|%ad).* [NC] RewriteRule .* - [F,L]`
3Discontinue using legacy PHP CGI mode; transition workloads to PHP-FPM or FastCGI with strict directive argument filtering.
4Restrict outbound Internet connectivity from web server DMZs to prevent C2 beaconing and secondary payload retrieval.

Detection Guidance & Threat Hunting

Inspect web server access logs for query parameters containing `%AD` or `\xad` followed by `allow_url_include` or `auto_prepend_file`. Monitor php-cgi.exe spawning cmd.exe, powershell.exe, or certutil.exe.

Sigma Detection Rule (SIEM Export)

title: PHP CGI Argument Injection CVE-2024-4577
status: critical
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - '%ad'
      - '%AD'
    cs-uri-query|contains|all:
      - 'allow_url_include'
      - 'auto_prepend_file'
  condition: selection

Affected Software & CPE Matrix

Targeted versions, patched releases, and Common Platform Enumerations

VendorProductAffected VersionsFixed In
PHP GroupPHPPHP 8.3 < 8.3.8, 8.2 < 8.2.20, 8.1 < 8.1.29 (all branches on Windows)PHP 8.3.8, 8.2.20, 8.1.29
Apache FriendsXAMPPAll Windows XAMPP installations with default CGI configurationsUpgrade PHP binary to >= 8.2.20 or disable CGI handling

Official Advisories & Authoritative Sources

DEVCORE Advisory: PHP CGI Argument Injection (CVE-2024-4577)https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
advisory
CISA KEV Catalog Entryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
cisa
PHP Official Release Announcementhttps://www.php.net/ChangeLog-8.php#8.3.8
patch

AI Agent & Security Automation Hub

TechOverwatch provides native machine-readable endpoints for autonomous agents, Cursor, Claude, ChatGPT, and automated patch scanners.

Agent CLI Command (curl):
curl -s https://www.techoverwatch.in/api/vulnerabilities/CVE-2024-4577/raw
Raw MarkdownJSON API