Intel

CVE-2024-4577

Argument Injection in PHP-CGI

criticalRansomwareKEV: actively exploitedPoCEPSS 100%

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Source: BSI_CSAFBSIOSVOSVCISA_KEVNVDCVEORGOSVCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2024-4577 is a complete bypass of the 2012-era CVE-2012-1823 patch, achieving unauthenticated remote code execution with no user interaction required (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The EPSS score of 0.9999 places it at the 100th percentile of exploitation likelihood, and CISA has confirmed active use in ransomware campaigns — making this a P0 incident for any organisation running PHP-CGI on Windows, including those using affected Oracle Communications products. NIS2-regulated operators should treat any unpatched, internet-facing instance as fully compromised and apply the patch or CGI-mode disable within 24 hours; the combination of trivial exploitability, no authentication barrier, and confirmed ransomware use leaves no room for a deferred remediation window.

Runbook · Step 1

Immediate response (0-24 h)

  • Patch immediately: Upgrade PHP on all Windows hosts to 8.1.29, 8.2.20, or 8.3.8 — these are the minimum fixed versions closing the CVE-2012-1823 bypass. Verify the exact build against the PHP Group changelog at php.net/ChangeLog before deploying.
  • Disable PHP-CGI mode: If patching cannot happen within the hour, remove php-cgi.exe from the Apache handler configuration and switch to PHP-FPM or mod_php — CGI mode is the only affected execution model; all other SAPI modes are unaffected.
  • Audit Oracle Communications deployments: All Oracle Communications instances (versions 5.1, 5.2, 9.1.1.3.0, 12.6.1.0.0, 15.0.0.0.0, 23.4.0, 23.4.2, 24.1.0) must be checked for embedded Windows PHP-CGI and patched via Oracle's Critical Patch Update (CPU) process.
  • Block malicious query-string patterns at the perimeter: Immediately configure WAF or reverse-proxy rules to reject requests containing URL-encoded characters such as %ad, %2b, or %2d appearing before a legitimate parameter separator — these are the characters exploited via Windows Best-Fit codepage conversion.
  • Identify high-risk Windows codepages: Systems running DBCS codepages (936/GBK, 950/Big5, 932/Shift-JIS) are the primary attack surface. Run chcp in the Apache service context and document results; these hosts are highest priority for emergency patching.

Runbook · Step 2

Mitigation layers

  • WAF/IPS rule (network layer): Block query strings that simulate PHP CLI options. Suricata rule concept: alert http any any -> $HTTP_SERVERS any (msg:"CVE-2024-4577 PHP-CGI exploit attempt"; content:"php-cgi"; http_uri; pcre:"/(\x25ad|\x25\x32\x64)/Ui"; sid:2024457701;). Tune threshold to avoid false positives on legitimate multi-byte character traffic.
  • Reverse-proxy hardening: Add an Apache mod_rewrite rule to block direct access to the CGI binary: RewriteRule ^/php-cgi/ - [F,L]. For Nginx: location ~ /php-cgi/ { deny all; }. This prevents direct invocation even if the handler is still configured.
  • Least-privilege for the CGI process: Run php-cgi.exe under a dedicated Windows service account with no local administrator rights and without SeImpersonatePrivilege. Apply an AppLocker or WDAC policy to restrict child processes spawnable from php-cgi.exe to an explicit allowlist.
  • Network segmentation: Move Windows PHP-CGI web servers into an isolated VLAN; restrict outbound connections from the web-server segment to known destinations only (database, logging, patch management). This limits post-exploitation lateral movement and C2 callback capability.
  • Endpoint hardening: Enable Sysmon or Windows Defender Application Control to alert on or block unexpected child processes of httpd.exe or php-cgi.exe — specifically cmd.exe, powershell.exe, wscript.exe, and mshta.exe.

Runbook · Step 3

Detection rules

  • Web access-log pattern: Entries with php-cgi in the URI path and query strings containing %ad, %2b, or %2d%2d — SPL: index=webserver sourcetype=access_combined uri_path="*php-cgi*" (uri_query="%ad*" OR uri_query="%2b*") | stats count by src_ip, uri_query.
  • Sysmon EID 1 — process ancestry: Child processes of php-cgi.exe or httpd.exe spawning cmd.exe, powershell.exe, wscript.exe, or mshta.exe — Sigma shape: ParentImage|endswith: 'php-cgi.exe' combined with Image|endswith: ['cmd.exe','powershell.exe','wscript.exe'].
  • Windows Event ID 4688 (process creation): New processes with php-cgi.exe as parent and command-line arguments matching PHP CLI flags — KQL: SecurityEvent | where EventID == 4688 and ParentProcessName endswith "php-cgi.exe" and CommandLine matches regex @"-(r|d|n)\s".
  • Network telemetry (Zeek/Suricata): Outbound connections from the web-server host to unknown external IPs occurring within seconds of HTTP requests matching the exploit query-string pattern — correlate http.log entries where uri ~ /php-cgi/ with subsequent conn.log entries where orig_h is the web-server IP and resp_h is not in the known-good allowlist.
  • Filesystem activity (Sysmon EID 11 / auditd): New files created by php-cgi.exe in web-root or temp directories — especially .php, .exe, .bat, or .ps1 extensions written within minutes of a suspicious HTTP request.

Metrics

Severity
critical
Priority score
220.18
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
100.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
100.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2025-08-11 13:54 UTC
CWE
CWE-78

Weakness classes (CWE)

  • CWE-78Base

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

    cwe.mitre.org →

Affected operating systems

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • bitnami

    php-min8.2.0

  • bitnami

    php-min8.3.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2024-4577
Argument Injection in PHP-CGI — CVE-2024-4577 | NEOSEC Intel