Argument Injection in PHP-CGI (CVE-2024-4577)

What is affected, what to do

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update PHP to version 8.1.29, PHP to version 8.2.20, PHP to version 8.3.8. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• PHP lt 8.1.0..8.1.29
• PHP lt 8.2.0..8.2.20
• PHP lt 8.3.0..8.3.8

Fixed in

• PHP 8.1.29
• PHP 8.2.20
• PHP 8.3.8

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade PHP to a patched release: 8.3.8, 8.2.20 or 8.1.29. End-of-life branches (8.0, 7.x) receive no fix — migrate or disable PHP-CGI immediately.
   • Prioritise Windows hosts running Apache with PHP-CGI. Inspect configs for cgi.force_redirect = 0 and any ScriptAlias/Action directive invoking php-cgi.exe. That combination is the attack surface.
   • Compensating control if patching is blocked: replace PHP-CGI with mod_php, PHP-FPM or FastCGI. Alternatively, use mod_rewrite to drop requests containing %AD (soft hyphen) in the query string or -d, -T, -s style arguments.
   • Confirm which Windows code page the server runs under. Code pages 932 (Japanese), 936 (Simplified Chinese), 949 (Korean) and 950 (Traditional Chinese) are confirmed vulnerable via Best-Fit mapping, but no code page should be considered safe without the patch.
   • Fence internet-exposed PHP-on-Windows hosts behind a WAF or take them offline until patch status is confirmed. Mass scanning and automated exploitation have been continuous since June 2024.
   • Review for post-exploitation: inspect PHP sessions, admin credential hashes, API keys, and any modifications to web.config/.htaccess or webroot files since June 2024.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: PHP-CGI hosts should only accept inbound HTTP(S) from the reverse proxy/WAF. Egress-filter outbound TCP 443/4444/8080 to unknown destinations to break reverse-shell callbacks.
   • WAF/IPS rule: block query strings containing %AD as well as those with a dash followed by PHP CLI switches (-d allow_url_include, -d auto_prepend_file, -T, -s, -n). Suricata/Snort signatures for CVE-2024-4577 are published by Emerging Threats and Talos — keep rulesets current.
   • Apache hardening: set cgi.force_redirect = 1, remove ScriptAlias entries pointing to php-cgi.exe, switch to mod_fcgid or a PHP-FPM socket. XAMPP installs with the default /php-cgi/php-cgi.exe alias must be reconfigured.
   • Endpoint hardening: switch Windows system locale to en-US or similar where Best-Fit behaviour is less exploitable. This does NOT replace the patch but shrinks the attack surface.
   • Least privilege: deny the Apache service account write access to webroot and block spawning of cmd.exe/powershell.exe from php-cgi.exe via AppLocker or WDAC.
   • Enable a monitoring tap on the reverse proxy and capture all 4xx/5xx responses with unusual query strings — attackers brute-force code-page variants.
3. 03

   Runbook step 3

   Detection rules

   • Web-server access logs: grep for %AD or decoded soft hyphens in query strings paired with .php paths. Sigma shape: selection.cs-uri-query|contains: ['%AD', '-d+allow_url_include', '-d+auto_prepend_file', '%ADd+'].
   • Sysmon EID 1 on Windows: php-cgi.exe as ParentImage spawning cmd.exe, powershell.exe, certutil.exe, curl.exe, whoami.exe — the standard post-exploitation chain. KQL: DeviceProcessEvents | where InitiatingProcessFileName == "php-cgi.exe" and FileName in ("cmd.exe","powershell.exe","certutil.exe","mshta.exe").
   • Sysmon EID 3/EID 22: outbound connections or DNS lookups from the php-cgi.exe process tree to non-business destinations — commonly Cobalt Strike beacons, Mirai variants, or cryptominer droppers.
   • File monitoring: new .php, .aspx or .bat files written to the webroot by the Apache service account (Sysmon EID 11). Short files in upload directories are classic webshell artefacts.
   • Network telemetry (Zeek/Suricata): HTTP requests carrying the %AD byte in the URI, especially in long query strings or POST bodies. Enable the ET OPEN signatures for CVE-2024-4577.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Source: NCSC NZ (CC BY 4.0), NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT, pwn.watch, OSV (Open Source Vulnerabilities), cvelistv5, BSI CSAF, BSI WID Portal

Vendors and products

• Fedora Project Infrastructure Fedora
• Oracle Communications
• PHP Group PHP
• PHP Group PHP

Weakness classes (CWE)

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  Base

  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  Entry at MITRE CWE-78

References & sources

• openwall.comlists/oss-security/2024/06/07/1web, Mailing list, Third-party advisory
• arstechnica.comsecurity/2024/06/php-vulnerability-allows-attackers-to-run-mali…web, Exploit, Press coverage, Third-party advisory
• blog.orange.tw2024/06/cve-2024-4577-yet-another-php-rce.htmlweb, Third-party advisory
• cert.been/advisory/warning-php-remote-code-execution-patch-immediatelyweb, Third-party advisory
• devco.reSecurity alert: CVE-2024-4577, PHP CGI argument injection vulnerabilityweb, Exploit, Third-party advisory, pwn-watch
• github.com11whoami99/CVE-2024-4577web, Exploit
• github.comGHSA-3qgc-jrrr-25jv: argument injection in PHP-CGIweb, Exploit, Third-party advisory, pwn-watch
• github.comrapid7/metasploit-framework/pull/19247web, Exploit, Issue tracking, Patch
• github.comwatchtowrlabs/CVE-2024-4577web, Exploit, Third-party advisory
• github.comxcanwin/CVE-2024-4577-PHP-RCEweb, Exploit, Third-party advisory
• isc.sans.edudiary/30994web, Exploit, Third-party advisory
• labs.watchtowr.comno-way-php-strikes-again-cve-2024-4577web, Exploit, Third-party advisory
• lists.fedoraproject.orgarchives/list/package-announce@lists.fedoraproject.org/message/…web, Mailing list
• lists.fedoraproject.orgarchives/list/package-announce@lists.fedoraproject.org/message/…web, Mailing list
• security.netapp.comadvisory/ntap-20240621-0008web, Third-party advisory
• imperva.comblog/imperva-protects-against-critical-php-vulnerability-cve-20…web, Third-party advisory
• php.netChangeLog-8.phpweb, Release notes
• php.netChangeLog-8.phpweb, Release notes
• php.netChangeLog-8.phpweb, Release notes
• vicarius.iovsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577web, Exploit, Third-party advisory