{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["CGI"],"platforms":["Windows"],"product":"PHP","repo":"https://github.com/php/php-src","vendor":"PHP Group","versions":[{"lessThan":"8.1.29","status":"affected","version":"8.1.*","versionType":"semver"},{"lessThan":"8.2.20","status":"affected","version":"8.2.*","versionType":"semver"},{"lessThan":"8.3.8","status":"affected","version":"8.3.*","versionType":"semver"}]}],"source":"security@php.net"},{"affectedData":[{"cpes":["cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*"],"defaultStatus":"affected","product":"php","vendor":"php_group","versions":[{"lessThan":"8.1.29","status":"affected","version":"8.1.0","versionType":"custom"}]},{"cpes":["cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"],"defaultStatus":"affected","product":"php","vendor":"php_group","versions":[{"lessThan":"8.2.20","status":"affected","version":"8.2.0","versionType":"custom"}]},{"cpes":["cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*"],"defaultStatus":"affected","product":"php","vendor":"php_group","versions":[{"lessThan":"8.3.8","status":"affected","version":"8.3.0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cisaActionDue":"2024-07-03","cisaExploitAdd":"2024-06-12","cisaRequiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"PHP-CGI OS Command Injection Vulnerability","configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"7DC2EEF8-834B-42A1-8DA3-0C2CF22A7070","versionEndExcluding":"8.1.29","versionStartIncluding":"8.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"A39988FF-D854-4277-9D66-6911AF371DD3","versionEndExcluding":"8.2.20","versionStartIncluding":"8.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"F579FFC1-4F81-4755-B14B-3AA73AC9FF7A","versionEndExcluding":"8.3.8","versionStartIncluding":"8.3.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*","matchCriteriaId":"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646","vulnerable":true},{"criteria":"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*","matchCriteriaId":"CA277A6C-83EC-4536-9125-97B84C4FAF59","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc."},{"lang":"es","value":"En las versiones de PHP 8.1.* anteriores a 8.1.29, 8.2.* anteriores a 8.2.20, 8.3.* anteriores a 8.3.8, cuando se usa Apache y PHP-CGI en Windows, si el sistema está configurado para usar ciertas páginas de códigos, Windows puede utilizar el comportamiento \"Mejor ajuste\" para reemplazar caracteres en la línea de comando proporcionada a las funciones de la API de Win32. El módulo PHP CGI puede malinterpretar esos caracteres como opciones de PHP, lo que puede permitir a un usuario malintencionado pasar opciones al binario PHP que se está ejecutando y, por lo tanto, revelar el código fuente de los scripts, ejecutar código PHP arbitrario en el servidor, etc."}],"id":"CVE-2024-4577","lastModified":"2026-06-17T08:02:11.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@php.net","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4577","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-06-15T03:55:28.430189Z","version":"2.0.3"}}]},"published":"2024-06-09T20:15:09.550","references":[{"source":"security@php.net","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2024/06/07/1"},{"source":"security@php.net","tags":["Exploit","Press/Media Coverage","Third Party Advisory"],"url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/"},{"source":"security@php.net","tags":["Third Party Advisory"],"url":"https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html"},{"source":"security@php.net","tags":["Third Party Advisory"],"url":"https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"},{"source":"security@php.net","tags":["Exploit","Third Party Advisory"],"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/"},{"source":"security@php.net","tags":["Exploit"],"url":"https://github.com/11whoami99/CVE-2024-4577"},{"source":"security@php.net","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv"},{"source":"security@php.net","tags":["Exploit","Issue Tracking","Patch"],"url":"https://github.com/rapid7/metasploit-framework/pull/19247"},{"source":"security@php.net","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/watchtowrlabs/CVE-2024-4577"},{"source":"security@php.net","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE"},{"source":"security@php.net","tags":["Exploit","Third Party Advisory"],"url":"https://isc.sans.edu/diary/30994"},{"source":"security@php.net","tags":["Exploit","Third Party Advisory"],"url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/"},{"source":"security@php.net","tags":["Mailing List"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"},{"source":"security@php.net","tags":["Mailing List"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"},{"source":"security@php.net","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20240621-0008/"},{"source":"security@php.net","tags":["Third Party Advisory"],"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/"},{"source":"security@php.net","tags":["Release Notes"],"url":"https://www.php.net/ChangeLog-8.php#8.1.29"},{"source":"security@php.net","tags":["Release Notes"],"url":"https://www.php.net/ChangeLog-8.php#8.2.20"},{"source":"security@php.net","tags":["Release Notes"],"url":"https://www.php.net/ChangeLog-8.php#8.3.8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2024/06/07/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Press/Media Coverage","Third Party Advisory"],"url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://blog.talosintelligence.com/new-persistent-attacks-japan/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"url":"https://github.com/11whoami99/CVE-2024-4577"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Patch"],"url":"https://github.com/rapid7/metasploit-framework/pull/19247"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/watchtowrlabs/CVE-2024-4577"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://isc.sans.edu/diary/30994"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20240621-0008/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://www.php.net/ChangeLog-8.php#8.1.29"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://www.php.net/ChangeLog-8.php#8.2.20"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://www.php.net/ChangeLog-8.php#8.3.8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577"}],"sourceIdentifier":"security@php.net","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security@php.net","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-78"}],"source":"nvd@nist.gov","type":"Primary"}]}