CVE-2024-4577

The problem stems from the 'Best-Fit' mechanism used by Windows when converting characters in selected code pages. When the operating system converts characters in arguments passed to Win32 API functions, the PHP-CGI module may incorrectly interpret these characters as PHP command-line options. An attacker can thus smuggle arbitrary options into the executed PHP binary without any authentication or user interaction.

An attacker can disclose PHP script source code or execute arbitrary PHP code on the server, which in practice means full takeover of the application and potentially the entire system.

PHP must be immediately updated to version 8.1.29, 8.2.20, or 8.3.8 (depending on the branch in use). If immediate update is not possible, consider disabling PHP-CGI mode or replacing it with PHP-FPM, and restrict access to the CGI endpoint at the firewall or Apache configuration level.

PHP versions 8.1.x before 8.1.29, 8.2.x before 8.2.20, and 8.3.x before 8.3.8 – only in Apache + PHP-CGI configuration on Windows with specific code pages.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.